Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
4fff8de46d9fb4c25d6e91fa17b86541.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4fff8de46d9fb4c25d6e91fa17b86541.exe
Resource
win10v2004-20231215-en
General
-
Target
4fff8de46d9fb4c25d6e91fa17b86541.exe
-
Size
1.7MB
-
MD5
4fff8de46d9fb4c25d6e91fa17b86541
-
SHA1
4f7b9c79bdcaee46ecf38f51e34881e2a7fc00f2
-
SHA256
605dfbbce76f11b4c7fadfc424d196c9d6528f3f73e87c371199eecb371cb45d
-
SHA512
5b85ee6039361fe87bc2530f609dbb642367d65d5cedb0113ea4aa7bbb5f1379808f9abee9377c1583f467df75059559e7bb85a7ea65561c9180c34fe334b137
-
SSDEEP
24576:5naDDcsA9B71i3ryMdFm0PSjMGGgwXUxmBbLqmdW9NyHjVs6jAGhkS3rJQBtUkBw:5aUBl1izznUUA59NUW2AEinXBgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1696 4fff8de46d9fb4c25d6e91fa17b86541.tmp -
Loads dropped DLL 4 IoCs
pid Process 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 1696 4fff8de46d9fb4c25d6e91fa17b86541.tmp 1696 4fff8de46d9fb4c25d6e91fa17b86541.tmp 1696 4fff8de46d9fb4c25d6e91fa17b86541.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1696 4fff8de46d9fb4c25d6e91fa17b86541.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1180 wrote to memory of 1696 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 28 PID 1180 wrote to memory of 1696 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 28 PID 1180 wrote to memory of 1696 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 28 PID 1180 wrote to memory of 1696 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 28 PID 1180 wrote to memory of 1696 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 28 PID 1180 wrote to memory of 1696 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 28 PID 1180 wrote to memory of 1696 1180 4fff8de46d9fb4c25d6e91fa17b86541.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fff8de46d9fb4c25d6e91fa17b86541.exe"C:\Users\Admin\AppData\Local\Temp\4fff8de46d9fb4c25d6e91fa17b86541.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\is-4OK21.tmp\4fff8de46d9fb4c25d6e91fa17b86541.tmp"C:\Users\Admin\AppData\Local\Temp\is-4OK21.tmp\4fff8de46d9fb4c25d6e91fa17b86541.tmp" /SL5="$70122,1460794,54272,C:\Users\Admin\AppData\Local\Temp\4fff8de46d9fb4c25d6e91fa17b86541.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1696
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
217B
MD558970ab949efb3d1aaf4a1c9e10dcba4
SHA15e99a91bcf0f3faeec5e810959b1b44b569250a7
SHA256c681b8bc68767331cf12e26c205b76a5358be941db973e55904e348cf21d66ec
SHA512a223b5ab94a4ce90f83b8ca373f9669b3b770edde3565e6ca49982ed3928ff935531f948e433363792042b448f4e7a12eee39d11ce50c328c6ffd5e089d22362
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
49KB
MD502ecc74f7f91e9ffd84de708683236a6
SHA13532de0b77df8b0fc89e9c7eddec3fa71f98f5a2
SHA25630ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e
SHA512a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541