Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 07:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d5980620789e028934a96097f0cbcad.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2d5980620789e028934a96097f0cbcad.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
2d5980620789e028934a96097f0cbcad.exe
-
Size
208KB
-
MD5
2d5980620789e028934a96097f0cbcad
-
SHA1
c30257f136d9aad18b1ec33d927b194b6e3ae601
-
SHA256
c62257a99d410a5c1fe9764a1bb9ed3b89bce688b599dafb74bbe02ef359672a
-
SHA512
a6a2da28a8f751f67da0e5967a7aa6da2288966ef38644e44be1a0bce0c21610c83ffcfd359225a4a8b0dedb8fd3b803c5422ae584f8d20634af918f80acda0f
-
SSDEEP
6144:mldxTC7qow3TW0ww7TjuCn7zUmQ7Y0pMWwBZx:+xEqPww7TjtzFQ7VpMWwZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2192 u.dll 2776 u.dll 2832 mpress.exe -
Loads dropped DLL 6 IoCs
pid Process 3056 cmd.exe 3056 cmd.exe 3056 cmd.exe 3056 cmd.exe 2776 u.dll 2776 u.dll -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3056 2928 2d5980620789e028934a96097f0cbcad.exe 17 PID 2928 wrote to memory of 3056 2928 2d5980620789e028934a96097f0cbcad.exe 17 PID 2928 wrote to memory of 3056 2928 2d5980620789e028934a96097f0cbcad.exe 17 PID 2928 wrote to memory of 3056 2928 2d5980620789e028934a96097f0cbcad.exe 17 PID 3056 wrote to memory of 2192 3056 cmd.exe 16 PID 3056 wrote to memory of 2192 3056 cmd.exe 16 PID 3056 wrote to memory of 2192 3056 cmd.exe 16 PID 3056 wrote to memory of 2192 3056 cmd.exe 16 PID 3056 wrote to memory of 2776 3056 cmd.exe 33 PID 3056 wrote to memory of 2776 3056 cmd.exe 33 PID 3056 wrote to memory of 2776 3056 cmd.exe 33 PID 3056 wrote to memory of 2776 3056 cmd.exe 33 PID 2776 wrote to memory of 2832 2776 u.dll 32 PID 2776 wrote to memory of 2832 2776 u.dll 32 PID 2776 wrote to memory of 2832 2776 u.dll 32 PID 2776 wrote to memory of 2832 2776 u.dll 32 PID 3056 wrote to memory of 1744 3056 cmd.exe 31 PID 3056 wrote to memory of 1744 3056 cmd.exe 31 PID 3056 wrote to memory of 1744 3056 cmd.exe 31 PID 3056 wrote to memory of 1744 3056 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d5980620789e028934a96097f0cbcad.exe"C:\Users\Admin\AppData\Local\Temp\2d5980620789e028934a96097f0cbcad.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6F3.tmp\vir.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\calc.exeCALC.EXE3⤵PID:1744
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776
-
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save 2d5980620789e028934a96097f0cbcad.exe.com -include s.dll -overwrite -nodelete1⤵
- Executes dropped EXE
PID:2192
-
C:\Users\Admin\AppData\Local\Temp\22DC.tmp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\22DC.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe22DD.tmp"1⤵
- Executes dropped EXE
PID:2832