Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
13b28d9f5431c4c4ede2badfd5892fee.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
13b28d9f5431c4c4ede2badfd5892fee.exe
Resource
win10v2004-20231215-en
General
-
Target
13b28d9f5431c4c4ede2badfd5892fee.exe
-
Size
854KB
-
MD5
13b28d9f5431c4c4ede2badfd5892fee
-
SHA1
e32014b0cbffc33d6f23c89d61e7367a4c917e29
-
SHA256
82b508beca25dadeb8467d3cfa719a6eb16ad870afda87dd5e40cf112520c983
-
SHA512
791a3436ad0dc5f18a2ec1ab304890c972f25db3218f0320f86e41949377793fd2d3c27ab98d4f83dd43cb9e498239e9b9a9db00f46b93ca4e2ef07ad2ecd2c7
-
SSDEEP
24576:Ji2sFbAw0o9MoxaK/uudvvPRBUCjcBEc//////i:TKjDM0VRB2Ec//////i
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2404 boxplayersetup.exe 2752 is-T1JBQ.tmp -
Loads dropped DLL 45 IoCs
pid Process 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 2404 boxplayersetup.exe 2404 boxplayersetup.exe 2404 boxplayersetup.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 2404 boxplayersetup.exe 2752 is-T1JBQ.tmp 2752 is-T1JBQ.tmp 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 1708 13b28d9f5431c4c4ede2badfd5892fee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2752 is-T1JBQ.tmp -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2404 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 19 PID 1708 wrote to memory of 2404 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 19 PID 1708 wrote to memory of 2404 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 19 PID 1708 wrote to memory of 2404 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 19 PID 1708 wrote to memory of 2404 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 19 PID 1708 wrote to memory of 2404 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 19 PID 1708 wrote to memory of 2404 1708 13b28d9f5431c4c4ede2badfd5892fee.exe 19 PID 2404 wrote to memory of 2752 2404 boxplayersetup.exe 18 PID 2404 wrote to memory of 2752 2404 boxplayersetup.exe 18 PID 2404 wrote to memory of 2752 2404 boxplayersetup.exe 18 PID 2404 wrote to memory of 2752 2404 boxplayersetup.exe 18 PID 2404 wrote to memory of 2752 2404 boxplayersetup.exe 18 PID 2404 wrote to memory of 2752 2404 boxplayersetup.exe 18 PID 2404 wrote to memory of 2752 2404 boxplayersetup.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\13b28d9f5431c4c4ede2badfd5892fee.exe"C:\Users\Admin\AppData\Local\Temp\13b28d9f5431c4c4ede2badfd5892fee.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\boxplayersetup.exeC:\Users\Admin\AppData\Local\Temp\boxplayersetup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\is-R25A9.tmp\is-T1JBQ.tmp"C:\Users\Admin\AppData\Local\Temp\is-R25A9.tmp\is-T1JBQ.tmp" /SL4 $70124 "C:\Users\Admin\AppData\Local\Temp\boxplayersetup.exe" 542035 517121⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD56cdb299575c0e210dbde97e253949aca
SHA1f1bd87b4321053b4c603b28829c3a0846e30e2c5
SHA2568cafad3fe092d0dae2ec64a08d63aefeb7014430bf26e0434db1e00352110cd4
SHA512602ef49bc1fcd15ada6f9b2b74cc48973096bae05f3cf647e004a043284ba8e2230de43fde3cc68b60cb5bb014961800a23325866f2b9a39db67da1c372e701d
-
Filesize
750KB
MD510e92421f33416c62e258d5c06f82c6a
SHA13273e6c5d30b7d9d4fc33d59d772a1129210f634
SHA256b82d6dbb11b2730f8ed6c3b8ee146c34aa9f7267337dd1d5f357a68691226677
SHA51274dd74af3ddda2cd867422e4fd51c1cedb48d46e540e0e5717cef70ae5d3d5e5e6f3ce5baea87a9ece1d129d49cc6aae7b42d96d73114385825675eb350f560d
-
Filesize
139KB
MD5c694f97a14273d0ebf6190bd13137eb3
SHA1940371555bf43b6dd5ef40ea610da01041e4bbba
SHA256a1e69341cdbbbca2ae73052518feb5a647f60fcb65a5931aa14e027a6775f64f
SHA512d05873e172586f557c995a5cac4e792067d48afae0a5776691ada3ce5fee01f41e0c2baf35bada963ccccf5b967cb8d82df8d82671bb79ae8c2771f043165a94
-
Filesize
93KB
MD5a8281300099566319b9c98b922d7ac91
SHA1b6a0c3d33e6ed76fa8856f9b1ce1943b13ae110b
SHA25646da5511b2e8fd4e3fcc769a3be5344bf412f2a894f57fa6e2f35225900502c9
SHA5124178ff770dc106869fa35b8557019059f5552c43b70eae99c46ad839f24ae6b094cbd07958a4b28577f00b3f68823329e335f19a61b8162100b7d96807ed334a
-
Filesize
10KB
MD5810f3a0aefe36a9f63e29e604bea91a9
SHA12559d3d4adf51f8ecbe2d07e669e344eb7d0bd80
SHA256f160eb7a1b4eb8d2e99e7424ae058acd81ba5019e43cbfa0ce81e3102b356779
SHA512836b73c38ab60260e1bc81ebf8347e14d02453fc361b7d6f10f137287b8189f8bc43758ce2d9def8fd1c71112aab7ef1930af2d64ae69f6d4e58a6fe17b310bb
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8