Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:09
Behavioral task
behavioral1
Sample
6647904c801ed31ace2a4b0825f9f53d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6647904c801ed31ace2a4b0825f9f53d.exe
Resource
win10v2004-20231215-en
General
-
Target
6647904c801ed31ace2a4b0825f9f53d.exe
-
Size
115KB
-
MD5
6647904c801ed31ace2a4b0825f9f53d
-
SHA1
a89142601b750a446cc11bbce8f508d63ea6e194
-
SHA256
8630f5d262d6f7d96386b54b91bb451871f8cda659a2049e8e6b59d784c7dc60
-
SHA512
924c0b4cc656981e20808f7aaf460b55efdafb84082c3ee00d95f752c049b62fcac0d6c29980ee593d746c40fb2210a75d307775da8877b26ce0f6c7dc1f2dd2
-
SSDEEP
3072:4Faap7m4QXJdVcvsDAoQEEmnsSld+0gBMLZUnCnq:4L7m4WPmkUozBnsSld+0gCLZA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1708 6647904c801ed31ace2a4b0825f9f53d.exe -
Loads dropped DLL 2 IoCs
pid Process 2932 6647904c801ed31ace2a4b0825f9f53d.exe 2932 6647904c801ed31ace2a4b0825f9f53d.exe -
resource yara_rule behavioral1/memory/2932-13-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral1/files/0x0034000000014b1a-9.dat upx behavioral1/memory/1708-18-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1708-17-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2932-0-0x0000000000400000-0x0000000000412000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1708 2932 6647904c801ed31ace2a4b0825f9f53d.exe 16 PID 2932 wrote to memory of 1708 2932 6647904c801ed31ace2a4b0825f9f53d.exe 16 PID 2932 wrote to memory of 1708 2932 6647904c801ed31ace2a4b0825f9f53d.exe 16 PID 2932 wrote to memory of 1708 2932 6647904c801ed31ace2a4b0825f9f53d.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\6647904c801ed31ace2a4b0825f9f53d.exe"C:\Users\Admin\AppData\Local\Temp\6647904c801ed31ace2a4b0825f9f53d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\Temp\MT\6647904c801ed31ace2a4b0825f9f53d.exe"C:\Windows\Temp\MT\6647904c801ed31ace2a4b0825f9f53d.exe"2⤵
- Executes dropped EXE
PID:1708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD599dec2f65470c254fdf4b8506c9ab12f
SHA1b0a285af8cdae249032a8f910615a86c7eb13beb
SHA2561feced1965f389fad8b3bd84b104027c46df4ac942b58dc93dfa5698d194f10f
SHA512977ca7f2e1c941e6ebb3eeeb76d53d79b7da5d47b692bc4bfce4aa3fec74851277f5744a6cff3b7af0585f1c9e86029f8154909302e370ff177dd71674ca88b7