Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 16:10
Static task
static1
Behavioral task
behavioral1
Sample
3d4cdd5244bb14eca5a4f4384fd78590.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3d4cdd5244bb14eca5a4f4384fd78590.exe
Resource
win10v2004-20231215-en
General
-
Target
3d4cdd5244bb14eca5a4f4384fd78590.exe
-
Size
10.7MB
-
MD5
3d4cdd5244bb14eca5a4f4384fd78590
-
SHA1
08f347725e5aa2c0434733027d08095fc5a64d66
-
SHA256
9520c20b1431811e993e8e54fd60a9e4d1f427aef3b78009d02bc6661379b6c5
-
SHA512
577f6286b28abc2dd8de6aad114358a7f91d2f0e8db812e412e31f41dfde104a64f9c827522088f77158ee62447c101b89622fb87681ea8e195cddd32e8be53a
-
SSDEEP
49152:EQFRHrmQG+yrV2JrmQG+yrVDAQG+yrVeUQG+yrV2JrmQG+yrVDAQG+UAQG+yrVeH:EcKvi/viA/wi/o
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2688 bmv.exe -
Loads dropped DLL 2 IoCs
pid Process 2280 3d4cdd5244bb14eca5a4f4384fd78590.exe 2280 3d4cdd5244bb14eca5a4f4384fd78590.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main bmv.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2688 bmv.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2688 bmv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2688 bmv.exe 2688 bmv.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2688 2280 3d4cdd5244bb14eca5a4f4384fd78590.exe 28 PID 2280 wrote to memory of 2688 2280 3d4cdd5244bb14eca5a4f4384fd78590.exe 28 PID 2280 wrote to memory of 2688 2280 3d4cdd5244bb14eca5a4f4384fd78590.exe 28 PID 2280 wrote to memory of 2688 2280 3d4cdd5244bb14eca5a4f4384fd78590.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d4cdd5244bb14eca5a4f4384fd78590.exe"C:\Users\Admin\AppData\Local\Temp\3d4cdd5244bb14eca5a4f4384fd78590.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\bmv.exeC:\Users\Admin\AppData\Local\Temp\bmv.exe -run C:\Users\Admin\AppData\Local\Temp\3d4cdd5244bb14eca5a4f4384fd78590.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD5d7731b0f548358f9534236893abccd17
SHA1278e9f2dda1cba15aeb8508251673a012a8b5f1c
SHA256adfa01c52512dabe73ab1065cafb098aa26fa8f9892c0ea35bc121bac64779cf
SHA512fbc8cc60e1c5ddebded5d61c4dfffc4f4d122d866474d881d77123d74978913d887880732c876a8691d79f63436b2d360ce9694f98ecb071922b54060460d87a
-
Filesize
5.4MB
MD55e30a7963a856b8908fe129537cc1dc6
SHA1302d3a7aac6ffbd6e24b7958827f930e39f03742
SHA256d558561bb2d934ee3f0df105ebc49816486c15af5bb9cdf7f836f30dbd64d823
SHA512c4e2b74fc071892cf69b3b1901dfe1be2f1f139f216eb71b35fb8026d62fb44d5fe4810efb683c2192f3e02667deca3501534a722955ad394c0efa371136fa7c
-
Filesize
11.0MB
MD504aa3fa154512d32eab7ebb56a60bc33
SHA1f5ef8f46f1564a1dc90f856c5e16bd33572d72c9
SHA25639f0498a890401409df3c584dd35721826bd13673db2bee0c781fb22bbd32937
SHA5123c83696a8bbbbded2f60b4694c4db3f152d6d71012ab821f6fca89e2c858a4c1bb3043980eef1c90cbfe1378e8be47732b240a25b004ed74cc258ede5e1dede5