Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
4566420e0500471cea5bfcb37cf4cfdd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4566420e0500471cea5bfcb37cf4cfdd.exe
Resource
win10v2004-20231215-en
General
-
Target
4566420e0500471cea5bfcb37cf4cfdd.exe
-
Size
10.7MB
-
MD5
4566420e0500471cea5bfcb37cf4cfdd
-
SHA1
310d569c575be88386a34ef1bcdc0472a3670ed6
-
SHA256
263b008e6d03d9247bbb9c40e29105054b98132788a2461a56cc44b8beb48ac6
-
SHA512
9adeafa898d72d90011c381a66f405c498684c23e1af3ae3672b0b8d0014092348f518584a36398bc59f918d5622f3954cfb8bce1e6c367a49ea07621613cd34
-
SSDEEP
196608:vYcxyOcAC1Llzsekjwma8V4NHf93Szpjc241Q7sPkjtVadhOIPY3o7RDmReJn+Tf:Rxyyyhs7a8V8Noc24KdadIW6MulVFKGt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2556 4566420e0500471cea5bfcb37cf4cfdd.tmp -
Loads dropped DLL 3 IoCs
pid Process 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 2556 4566420e0500471cea5bfcb37cf4cfdd.tmp 2556 4566420e0500471cea5bfcb37cf4cfdd.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2556 4566420e0500471cea5bfcb37cf4cfdd.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2556 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 18 PID 2088 wrote to memory of 2556 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 18 PID 2088 wrote to memory of 2556 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 18 PID 2088 wrote to memory of 2556 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 18 PID 2088 wrote to memory of 2556 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 18 PID 2088 wrote to memory of 2556 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 18 PID 2088 wrote to memory of 2556 2088 4566420e0500471cea5bfcb37cf4cfdd.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\4566420e0500471cea5bfcb37cf4cfdd.exe"C:\Users\Admin\AppData\Local\Temp\4566420e0500471cea5bfcb37cf4cfdd.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\is-9LBLE.tmp\4566420e0500471cea5bfcb37cf4cfdd.tmp"C:\Users\Admin\AppData\Local\Temp\is-9LBLE.tmp\4566420e0500471cea5bfcb37cf4cfdd.tmp" /SL5="$400F4,10891445,52736,C:\Users\Admin\AppData\Local\Temp\4566420e0500471cea5bfcb37cf4cfdd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2556
-