Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
180085d856d91d3e6e02b6c257c95238.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
180085d856d91d3e6e02b6c257c95238.exe
Resource
win10v2004-20231215-en
General
-
Target
180085d856d91d3e6e02b6c257c95238.exe
-
Size
1.8MB
-
MD5
180085d856d91d3e6e02b6c257c95238
-
SHA1
5ee16b4b8b64009dc72beac3bb360b07907b0d0b
-
SHA256
39edc48d5880e4793b1593a42387132c7f44d3d0f74a216d97f5062ffc425461
-
SHA512
8e8fe679d6ef94b5313040dcd5186e57c2a3eaed9e4928757acc64987f6f9f4793839565a2bdcba73778449f3b7c6ed55fb4fefddcdab9f4014a05cce716b262
-
SSDEEP
49152:5ahNFV6kabM5i3pLNUB1O5WfcN8Cr+QYI9d1bCinXBgJ:QhNFUp535NFwENnr+1AbBRgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1416 180085d856d91d3e6e02b6c257c95238.tmp -
Loads dropped DLL 4 IoCs
pid Process 2808 180085d856d91d3e6e02b6c257c95238.exe 1416 180085d856d91d3e6e02b6c257c95238.tmp 1416 180085d856d91d3e6e02b6c257c95238.tmp 1416 180085d856d91d3e6e02b6c257c95238.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1416 180085d856d91d3e6e02b6c257c95238.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2808 wrote to memory of 1416 2808 180085d856d91d3e6e02b6c257c95238.exe 17 PID 2808 wrote to memory of 1416 2808 180085d856d91d3e6e02b6c257c95238.exe 17 PID 2808 wrote to memory of 1416 2808 180085d856d91d3e6e02b6c257c95238.exe 17 PID 2808 wrote to memory of 1416 2808 180085d856d91d3e6e02b6c257c95238.exe 17 PID 2808 wrote to memory of 1416 2808 180085d856d91d3e6e02b6c257c95238.exe 17 PID 2808 wrote to memory of 1416 2808 180085d856d91d3e6e02b6c257c95238.exe 17 PID 2808 wrote to memory of 1416 2808 180085d856d91d3e6e02b6c257c95238.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\180085d856d91d3e6e02b6c257c95238.exe"C:\Users\Admin\AppData\Local\Temp\180085d856d91d3e6e02b6c257c95238.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\is-ILIUK.tmp\180085d856d91d3e6e02b6c257c95238.tmp"C:\Users\Admin\AppData\Local\Temp\is-ILIUK.tmp\180085d856d91d3e6e02b6c257c95238.tmp" /SL5="$4014E,1502797,54272,C:\Users\Admin\AppData\Local\Temp\180085d856d91d3e6e02b6c257c95238.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1416
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891