Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1559s -
max time network
1565s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 20:23
Behavioral task
behavioral1
Sample
EntityClumsy.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
EntityClumsy.exe
Resource
win10v2004-20231222-en
General
-
Target
EntityClumsy.exe
-
Size
17.7MB
-
MD5
1704d83265851952bb65f07c6a4e4195
-
SHA1
d0e71fcd720ecc44411a57fd432b710911034a14
-
SHA256
893491377ed98ebb93812d1f3efdd4e2b78e0bad4c76c21fef6640a5f99530fa
-
SHA512
9c4c7dacfb01b5d8a8ef0e411678fcfa60b9a987ed76a5e19b546144d44f91b53b46cbdce85dfe06e67f3880e4c21f0e385c7d7e4cca4d1ed988ac7b8f4437ff
-
SSDEEP
393216:dqPnLFXlreQpDOETgsvfGFw2gzKfvEqx9X6bq:kPLFXNeQoEKWKkSXL
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1648 EntityClumsy.exe -
resource yara_rule behavioral1/files/0x000500000001a3df-111.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1648 2336 EntityClumsy.exe 28 PID 2336 wrote to memory of 1648 2336 EntityClumsy.exe 28 PID 2336 wrote to memory of 1648 2336 EntityClumsy.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\EntityClumsy.exe"C:\Users\Admin\AppData\Local\Temp\EntityClumsy.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\EntityClumsy.exe"C:\Users\Admin\AppData\Local\Temp\EntityClumsy.exe"2⤵
- Loads dropped DLL
PID:1648
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378