Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/12/2023, 04:22
General
-
Target
toolsbox-v18.exe
-
Size
8.2MB
-
MD5
616b5ca5dac5f19f82374d6fc255ac7c
-
SHA1
4d5f23bfd2f2f4f3f14e490e7c282355ee49dcbe
-
SHA256
1be40f1b610ff4e4c46f0f378435d4735bf97ae2f29874ad4faafa4e892b088a
-
SHA512
716874a618061a84a339ad54e3ba30bb10c323f2bfab3de09df3fe79637537a6089fe1dc5479e7cf906b972c8c3496894bdb2770ea605e7d4bcd22b2182fd00f
-
SSDEEP
196608:VFEZhR/MRkw+V3SJybsNLat3geDg9EblM54CEstZ3P4rpT:VuBsNz9QlM6vAFOR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\is-7PJTJ.tmp\toolsbox-v18.tmp"C:\Users\Admin\AppData\Local\Temp\is-7PJTJ.tmp\toolsbox-v18.tmp" /SL5="$400E4,8359225,52224,C:\Users\Admin\AppData\Local\Temp\toolsbox-v18.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\toolsbox-v18.exe"C:\Users\Admin\AppData\Local\Temp\toolsbox-v18.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD550c6251a41048ef68107f77085db4a5c
SHA113b031c2865a8de9274aca2f3cbacc43820bd276
SHA256a6faf1c880e002d1aa73d8e01e72a4b4a0ae7967a14ad6ff9f3078c8d3cbf7fd
SHA512208e54ce695ae2335232687503b83fb08432527308403dbaeab4e6cfcc61e84238bc883fe285aeb634e26175e26870649eee45633174b8ea3701c666a7460597
-
Filesize
28KB
MD5a636d1a32e760ed8a0ace8507afb24a7
SHA149ef89bb74a33469f724faba59800b41d07ad768
SHA256578e574971244509ff862ea76b18b0b79592861116efdce46f7d762f23259447
SHA5126b8939bb5e52d8e53607f845a22b7dcd91cb14bc3edf5a48cbfbb7ad0004f22916a2758ecc80e61368fd758fb0d03b425a25b7d8afddae5ef86123a4a430771e
-
Filesize
5KB
MD5dc887c96a6963f1f531512bea0215323
SHA19874d75efaa66ce9e6b59a06ab7ac7cc270a8b86
SHA2569723510c8d18d0186e00ee7884b14ee21adeafe4c6d4c5f87aea8255c2e66838
SHA512f1d9debcb5e2de1f4b56bc19ac32d209d616f142ae1467ed0b8fb5e58effee45af06fab78271dbf524b63264d89add732fcbc97c1db7e3ca7d55bf0872399006
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
4KB
-
Filesize
772KB
-
Filesize
4KB