Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/01/2024, 21:57
General
-
Target
AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe
-
Size
1.6MB
-
MD5
c656855186dedce4c57f1eedb3bdf242
-
SHA1
0663f5d6cdee325bc0be279f7e81f150921c6a96
-
SHA256
ad1795113e302772c08f24c6c1947da43b2b9c82c77c9c906ec616fb39214f8b
-
SHA512
4ed2150b213bfadbf7f2513eb6159d67d0b6410c55db0c533fb1b577474559f52d3ee3fcdcbf89cea5aaf1b9f72d77c6de6bc61acf9017e9f700d80a590569b5
-
SSDEEP
24576:s7FUDowAyrTVE3U5F/midGKic6QL3E2vVsjECUAQT45deRV9RJ:sBuZrEUAKIy029s4C1eH9P
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe"C:\Users\Admin\AppData\Local\Temp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5MSUM.tmp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.tmp"C:\Users\Admin\AppData\Local\Temp\is-5MSUM.tmp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.tmp" /SL5="$400E2,832512,832512,C:\Users\Admin\AppData\Local\Temp\AD1795113E302772C08F24C6C1947DA43B2B9C82C77C9.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD59f2b0a7592a5085bbc343863e47966c8
SHA1a2344b1f925221c1e1861b1a29d149c0cf2b0e4d
SHA2566158145460959c5bbd215c15230046c5f7a0ac10250bb7efb1538c4aba335dc2
SHA512f6d6dd1dfff43df25a02caa9084d4ac606b5465a90fa43a26e62fa34aa4f467af96e5df49bd7c1d66431f6ee66041843e4bdde333761c1ff3e3d194e6f19816a
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
4KB