Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
1365acb79231a0e049f531b75e51f9ce.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1365acb79231a0e049f531b75e51f9ce.exe
Resource
win10v2004-20231215-en
General
-
Target
1365acb79231a0e049f531b75e51f9ce.exe
-
Size
45KB
-
MD5
1365acb79231a0e049f531b75e51f9ce
-
SHA1
a9a27ee2313679cbf880566fbfc932646b1f4758
-
SHA256
8daf7b7ce8fbd09a648fc914de66aec6cb0d2d2869fa4cc37d7b41e31c1d0ddc
-
SHA512
7e07afeaab48e14833d489b4b0d235b205988e055cc3f3109051fc39c572285f12c6e401074344d09ed8e92048cfc26e0572db8aa2fa535ca203a7eb09382e28
-
SSDEEP
768:7LGsbcFm1S6Gw/eqzLIFl/7iad2Tf8BdHKJf5FhqKIXTM+PIpDQCQo+dbwIPDv:/G4cFsGo1ad2oDqJfMXbPL3dR
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1816 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 748 pqxqdehy.exe -
Loads dropped DLL 2 IoCs
pid Process 2772 1365acb79231a0e049f531b75e51f9ce.exe 2772 1365acb79231a0e049f531b75e51f9ce.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2772 1365acb79231a0e049f531b75e51f9ce.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2772 wrote to memory of 748 2772 1365acb79231a0e049f531b75e51f9ce.exe 31 PID 2772 wrote to memory of 748 2772 1365acb79231a0e049f531b75e51f9ce.exe 31 PID 2772 wrote to memory of 748 2772 1365acb79231a0e049f531b75e51f9ce.exe 31 PID 2772 wrote to memory of 748 2772 1365acb79231a0e049f531b75e51f9ce.exe 31 PID 2772 wrote to memory of 1816 2772 1365acb79231a0e049f531b75e51f9ce.exe 32 PID 2772 wrote to memory of 1816 2772 1365acb79231a0e049f531b75e51f9ce.exe 32 PID 2772 wrote to memory of 1816 2772 1365acb79231a0e049f531b75e51f9ce.exe 32 PID 2772 wrote to memory of 1816 2772 1365acb79231a0e049f531b75e51f9ce.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\1365acb79231a0e049f531b75e51f9ce.exe"C:\Users\Admin\AppData\Local\Temp\1365acb79231a0e049f531b75e51f9ce.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\ProgramData\bglebijy\pqxqdehy.exeC:\ProgramData\bglebijy\pqxqdehy.exe2⤵
- Executes dropped EXE
PID:748
-
-
C:\Windows\SysWOW64\cmd.exe/c del /f C:\Users\Admin\AppData\Local\Temp\1365AC~1.EXE.bak >> NUL2⤵
- Deletes itself
PID:1816
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD51365acb79231a0e049f531b75e51f9ce
SHA1a9a27ee2313679cbf880566fbfc932646b1f4758
SHA2568daf7b7ce8fbd09a648fc914de66aec6cb0d2d2869fa4cc37d7b41e31c1d0ddc
SHA5127e07afeaab48e14833d489b4b0d235b205988e055cc3f3109051fc39c572285f12c6e401074344d09ed8e92048cfc26e0572db8aa2fa535ca203a7eb09382e28