Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:31
Static task
static1
Behavioral task
behavioral1
Sample
2a191009fb7b2665ee2f1f78a6f38211.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2a191009fb7b2665ee2f1f78a6f38211.exe
Resource
win10v2004-20231222-en
General
-
Target
2a191009fb7b2665ee2f1f78a6f38211.exe
-
Size
2.5MB
-
MD5
2a191009fb7b2665ee2f1f78a6f38211
-
SHA1
a15fd55d33a4484cde777089a50dd6a73938c540
-
SHA256
f91f8abfb1586925a6096ffd1a862550211a55d286cd0394d4ab984a529e4c58
-
SHA512
15daf728e0dcc43b24ed35de35c2d5682df7b1664c48a7a8f41ff6aba4d7f60608123477a0a7daef702dc1ded937066c93c3c8e4f6e25d54c98fd90d54a6285f
-
SSDEEP
49152:oky796EvMtTx435MtV+Oj29Ls3t/cwCxHHlc2KP1z8o/MO2Uqed3yBI1rp:o7AEvgVOy29Ls3JslVYzjMO26ie
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 2336 WMF.exe -
Loads dropped DLL 5 IoCs
pid Process 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2336 WMF.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2424 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 17 PID 2508 wrote to memory of 2424 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 17 PID 2508 wrote to memory of 2424 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 17 PID 2508 wrote to memory of 2424 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 17 PID 2508 wrote to memory of 2424 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 17 PID 2508 wrote to memory of 2424 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 17 PID 2508 wrote to memory of 2424 2508 2a191009fb7b2665ee2f1f78a6f38211.exe 17 PID 2424 wrote to memory of 2336 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 16 PID 2424 wrote to memory of 2336 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 16 PID 2424 wrote to memory of 2336 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 16 PID 2424 wrote to memory of 2336 2424 2a191009fb7b2665ee2f1f78a6f38211.tmp 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\is-KBR0D.tmp\WMF.exe"C:\Users\Admin\AppData\Local\Temp\is-KBR0D.tmp\WMF.exe" /aid=0 /sub=0 /sid=42 /name="4.rar" /fid= /stats=cS71pQPkuOys9C/drFU6n3IGsFZjWHRvzkHz3c2b3dwwR8mVZjZgLS2XN8hbXBHVQJx8wSdATUdUxi47zhaKew== /param=01⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336
-
C:\Users\Admin\AppData\Local\Temp\is-RHR5G.tmp\2a191009fb7b2665ee2f1f78a6f38211.tmp"C:\Users\Admin\AppData\Local\Temp\is-RHR5G.tmp\2a191009fb7b2665ee2f1f78a6f38211.tmp" /SL5="$3009A,2280122,153088,C:\Users\Admin\AppData\Local\Temp\2a191009fb7b2665ee2f1f78a6f38211.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424
-
C:\Users\Admin\AppData\Local\Temp\2a191009fb7b2665ee2f1f78a6f38211.exe"C:\Users\Admin\AppData\Local\Temp\2a191009fb7b2665ee2f1f78a6f38211.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD51969e47c426b8837edbdbbf0549ee6a4
SHA112bde3c18052d50f179771bfdfb15d1f2361b0d5
SHA256d5a7882c1d8623c628c931145b43364457e574b637b72052a28af92f217fd35b
SHA51225f70473dde14d049653cc0413d0df9111527711845fdaaa338359b637b685fc2c1009ed07eff058d7ec2fe1361b04f17bfd5868cae69f220b8d8e2e8333182b
-
Filesize
92KB
MD54cb044d57bddd0b705aa5b7830fd5b5a
SHA1ddce53d16b07aae98dbf8569b4d995af98cc0bad
SHA256e487de6d91828f8d2e9b36a27326c37041931bb87c8e5a9f5819e47d7ea7bdde
SHA512813f811f758980e8b6b25b2366e5fbf355767250ea78c7d878f11539ef2499af2fe983183ec4648ffd4461b335a5767b3b39fd251bee8cb08d461fd3455404b0
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
96KB
MD50891fb7e8219987c7fefbf7b230ddf09
SHA14a8624e7a6a90a973c78892e36a82980ce855bf3
SHA2564e12a0daede8c5917d94c57e6648888c85d8547a68f30b30319b33e68e857ef4
SHA512e76770dd899bcfa8c5d76a9397f6c1dd1463e53744886e5f50870678de6a1506e5a25ec82e3388487b0136fc472e97c01a5a0afeab19a4c61810696707f6ec2f