Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 02:39
Static task
static1
Behavioral task
behavioral1
Sample
524fd5b6e3cc155ea10ac84d42d87ca2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
524fd5b6e3cc155ea10ac84d42d87ca2.exe
Resource
win10v2004-20231215-en
General
-
Target
524fd5b6e3cc155ea10ac84d42d87ca2.exe
-
Size
41KB
-
MD5
524fd5b6e3cc155ea10ac84d42d87ca2
-
SHA1
4b842b70d55dc127c84a4fbbd02b595cf59eb9c6
-
SHA256
e61e9e45dbf2f7ec988478840963279b5d36a3aca13ddede09e2256cc7a7693f
-
SHA512
4605ec19131fd8764c02358cde2548bab94b43fb7427902e5ee68a0c4f09abd42b43e618508e6757d6e1ec6578c6c5aec468a79f2abcb74232817b961171dea2
-
SSDEEP
768:xoLjEjX99ddWMr+I1WlEkuqFeBGtrfYeqqD:WMX9n7kuN4sls
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2656 2780 524fd5b6e3cc155ea10ac84d42d87ca2.exe 29 PID 2780 wrote to memory of 2656 2780 524fd5b6e3cc155ea10ac84d42d87ca2.exe 29 PID 2780 wrote to memory of 2656 2780 524fd5b6e3cc155ea10ac84d42d87ca2.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\524fd5b6e3cc155ea10ac84d42d87ca2.exe"C:\Users\Admin\AppData\Local\Temp\524fd5b6e3cc155ea10ac84d42d87ca2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CryptischerMist.bat" "2⤵PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36B
MD5076697540dc22bae9831a47b91f9d061
SHA122944d2cb4087ee1cfe16f349f4e25a2b420a482
SHA2568a10ce98121abc2fdfeadcdc28a2641296ecfecfb5921b19fbff9b41807e4e27
SHA5122ab76759b28806d0fd5037e525a0fbe6233aef821d1f7d62b80f0fd1f474692757a73839fd7ab215c09f4e6f44d005efb7f028c3090f1a8c7b08ee0a3ea7009d