Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 11:32
Static task
static1
Behavioral task
behavioral1
Sample
1734abe3407f61e9ae95c46ba0f94b2a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1734abe3407f61e9ae95c46ba0f94b2a.exe
Resource
win10v2004-20231222-en
General
-
Target
1734abe3407f61e9ae95c46ba0f94b2a.exe
-
Size
84KB
-
MD5
1734abe3407f61e9ae95c46ba0f94b2a
-
SHA1
168ecd346b31b10dc710b9bef26ae62a67888ddb
-
SHA256
e5989273e7c025a7dd2801cf410667e84755f17dc9cc9a0e6e2f5e33dc01c29e
-
SHA512
61dba6e7aa79482390e480a6d9d9e4e87d73eb02be5146f99e05247de243864e7f6302c98841e50ed5d63b4fb64369f6e3755211977f683eb90b6d77c74253f1
-
SSDEEP
1536:3ODUngi71V1f8TjQDkF2l3BPoesXv8So3fpl1hFasN:eDUngiD1f8TjQDkF21lHO8SkPhp
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1996 1734abe3407f61e9ae95c46ba0f94b2a.exe 1996 1734abe3407f61e9ae95c46ba0f94b2a.exe -
resource yara_rule behavioral1/memory/1996-3-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1996-2-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1996-1-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1996-5-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1996-6-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1996-21-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1996-11-0x0000000000400000-0x000000000041B000-memory.dmp upx behavioral1/memory/1996-9-0x0000000000400000-0x000000000041B000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2912 1996 WerFault.exe 19 -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1996 1734abe3407f61e9ae95c46ba0f94b2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1734abe3407f61e9ae95c46ba0f94b2a.exe"C:\Users\Admin\AppData\Local\Temp\1734abe3407f61e9ae95c46ba0f94b2a.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
PID:1996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 1282⤵
- Program crash
PID:2912
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5b4c9ba56daa490aac10f837beb943cfe
SHA16972e8e7382773224213cd67792c15ae6cc07363
SHA256635b715d328d6f69eca75d3ab9f6482fcd86ddbeae4b11dea1b6266b368a7a2f
SHA512cbe592b39ca4b210c9075089b34fdebbef7e569f2d2cfb5d5ac53d411959aa7c19033845cbeb2eb84bcc6b692159c29488c31fb640319fc2cc16119dce5d645f
-
Filesize
98KB
MD5cf97e692621c6365324978d8a4b7999e
SHA19bc6185207a68b72a06fdc310a0cdd7e2df02e36
SHA25691970cfc5436ed2868ccdb5cee4651211ee626727a68e9caba16198bae05de0e
SHA5126b1f4474490b4693f30b2898c92baed38c97da1cbbe3b623b2e7bbe00aca356b4f89e96940a3bc9b1cca7e8c5ab9ceb6b5f5ff3e985dbda7d7776816b8609467