Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe
Resource
win10v2004-20231215-en
General
-
Target
0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe
-
Size
3.1MB
-
MD5
61364a6fe5efd106c01a7c36ba09abb7
-
SHA1
90022820444fb45fc831513b51c5f6adaf092307
-
SHA256
0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf
-
SHA512
33b82aebe4d1a03f8703d4b4618c2dc7e964eba37701b3ba6acfba8cb20f43eb11c5bbde17cab37e8f364160cee8146102a63609216081cc9b01987cf72e3847
-
SSDEEP
98304:ystRgLsp8zU/sb5dYLQ5gDxyhQokALsRXzppn:ywgLuz/sb5fyUKJcsN
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2352 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2352 2208 0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe 28 PID 2208 wrote to memory of 2352 2208 0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe 28 PID 2208 wrote to memory of 2352 2208 0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe 28 PID 2208 wrote to memory of 2352 2208 0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe 28 PID 2208 wrote to memory of 2352 2208 0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe 28 PID 2208 wrote to memory of 2352 2208 0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe 28 PID 2208 wrote to memory of 2352 2208 0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe"C:\Users\Admin\AppData\Local\Temp\0a8839b793adedb6f3b7882cd3ff2aca653b29aefe4091969bceffae430b6eaf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" SJLNH.u /S2⤵
- Loads dropped DLL
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD58c020ef7a3fb68c7adde46c9d784b109
SHA14236297bbc983e21358873ea63ba22f91d95b342
SHA2568c5fb9918b8f524fd8c3c7dec99f848c96a7ac4155d0a33f64530c476c9bdda0
SHA5122d841485a777c4657e8115a4262b9bba1d335f40d8eda671e5b20481d41811c653779d828feb4f029e4153d364e8bc46dc02c363a72cf639c2e069a1f707783e
-
Filesize
2.0MB
MD5de9e0a5be6fe0b3344e53cb9c55be1c6
SHA19ad4e6745f9e7900aaa50621f5aac74f9e624dd7
SHA2566a536c471957916cc58b012d5eb537cb8124ab6e31744afee708aaf26b9dbd8c
SHA51274db68f9818c2e41e358d22204b2f6f809590903454b2825d470a2fc578dd76933f47c6dcec7e573c09e769dc0d7ab0c00c6c9f0c7f32272224c3d09123ddab9