Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/01/2024, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
577d6267157cab41b0408487d3c7f7ea.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
577d6267157cab41b0408487d3c7f7ea.exe
Resource
win10v2004-20231215-en
General
-
Target
577d6267157cab41b0408487d3c7f7ea.exe
-
Size
57KB
-
MD5
577d6267157cab41b0408487d3c7f7ea
-
SHA1
c5e8b8c7ec1406c57018675ebcee52f236989301
-
SHA256
6320dce0b9dd18eb67836eb888b6c5bec6d43c2ec71a1ee40e3e4785c7867acb
-
SHA512
55f537906e15f2f7cf04f8877d681530b9ac138839613b033ddc33b5a6bc478125906d1480a941c68c3540f1d983cad8a41eaa7206c1b535915eed76d45c51b0
-
SSDEEP
768:vCru/f9Iw/E6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpRiTWNReOOf:71Tzy48untU8fOMEI3jyYfPiuOf
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2808 2244 577d6267157cab41b0408487d3c7f7ea.exe 29 PID 2244 wrote to memory of 2808 2244 577d6267157cab41b0408487d3c7f7ea.exe 29 PID 2244 wrote to memory of 2808 2244 577d6267157cab41b0408487d3c7f7ea.exe 29 PID 2244 wrote to memory of 2808 2244 577d6267157cab41b0408487d3c7f7ea.exe 29 PID 2808 wrote to memory of 2720 2808 cmd.exe 30 PID 2808 wrote to memory of 2720 2808 cmd.exe 30 PID 2808 wrote to memory of 2720 2808 cmd.exe 30 PID 2808 wrote to memory of 2720 2808 cmd.exe 30 PID 2720 wrote to memory of 2692 2720 iexpress.exe 31 PID 2720 wrote to memory of 2692 2720 iexpress.exe 31 PID 2720 wrote to memory of 2692 2720 iexpress.exe 31 PID 2720 wrote to memory of 2692 2720 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\577d6267157cab41b0408487d3c7f7ea.exe"C:\Users\Admin\AppData\Local\Temp\577d6267157cab41b0408487d3c7f7ea.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\5782.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\577d6267157cab41b0408487d3c7f7ea.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2692
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
57KB
MD516b1977a1d96bdac1fa6a0b180cac96f
SHA1b8f2e602a4ae584db083cddfa4ee7645d8426377
SHA2569427973d582175cb6a672108c92148f7c69844259a4491cd2a408def3c1bd829
SHA5121a87e21498f0a64a8eca521a083b80826b638535f65719245711166ade7f8c02350e6db3fb6e7c29c6261e60c4c20bdc2dafaca9cc582fd7c9da134a087e4d0f
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083