Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
55a55d541bdbc613f58c4ba44853dc5e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
55a55d541bdbc613f58c4ba44853dc5e.exe
Resource
win10v2004-20231222-en
General
-
Target
55a55d541bdbc613f58c4ba44853dc5e.exe
-
Size
20.0MB
-
MD5
55a55d541bdbc613f58c4ba44853dc5e
-
SHA1
8f17f2ff978843009ffe298da6f73c334901200a
-
SHA256
9100f6dcb4a3910c315ca6615622612058cb200476ef2015d2b3fba6a850d1fb
-
SHA512
ba5e7d78bbbe8f890bac77e163d156c2770d14d444f06be0256a86bcff6c4c071e3ea387431468e1e14195f9b98f049b53f2ec68e9eec727778b95d2373f2a79
-
SSDEEP
393216:i0fvHwVgI2Q0wyla7aT1egGDwsUCQBVKNI77P29/b/vw72299u2EXC0nPbFs75yT:i0fod4iaZkipKK3eFb/IJgC0TFsF5HIP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2212 is-HAK1T.tmp -
Loads dropped DLL 3 IoCs
pid Process 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 2212 is-HAK1T.tmp 2212 is-HAK1T.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2212 is-HAK1T.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2212 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 21 PID 2948 wrote to memory of 2212 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 21 PID 2948 wrote to memory of 2212 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 21 PID 2948 wrote to memory of 2212 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 21 PID 2948 wrote to memory of 2212 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 21 PID 2948 wrote to memory of 2212 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 21 PID 2948 wrote to memory of 2212 2948 55a55d541bdbc613f58c4ba44853dc5e.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\55a55d541bdbc613f58c4ba44853dc5e.exe"C:\Users\Admin\AppData\Local\Temp\55a55d541bdbc613f58c4ba44853dc5e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\is-BAUPU.tmp\is-HAK1T.tmp"C:\Users\Admin\AppData\Local\Temp\is-BAUPU.tmp\is-HAK1T.tmp" /SL4 $5014C "C:\Users\Admin\AppData\Local\Temp\55a55d541bdbc613f58c4ba44853dc5e.exe" 20761769 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2212
-