Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
6644075ef4ba5b9126bb275b74b5560e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6644075ef4ba5b9126bb275b74b5560e.exe
Resource
win10v2004-20231215-en
General
-
Target
6644075ef4ba5b9126bb275b74b5560e.exe
-
Size
49KB
-
MD5
6644075ef4ba5b9126bb275b74b5560e
-
SHA1
e63dafe3cbffadd8403e1a75d70423e80093daf8
-
SHA256
8d33421d8f55c2d5d88243f4e4181df691a9602f1c14fae1407aeaf7370751ac
-
SHA512
4877572dba4cab9e38ef3d43f0261949193f16fab873bbe58f363e83cd664fc19d32a6c49c5a429caed3e0a120c38b1d9e71ccf112c22e428d3f611464ea9355
-
SSDEEP
768:EyW1yBtObv0U/xwPp0EoooiYECG2nZF5sZVcmx3J:24Bobv7aB0EooYEC3rUVcY3J
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2304 zbhnd.exe -
Loads dropped DLL 1 IoCs
pid Process 2692 6644075ef4ba5b9126bb275b74b5560e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2304 2692 6644075ef4ba5b9126bb275b74b5560e.exe 29 PID 2692 wrote to memory of 2304 2692 6644075ef4ba5b9126bb275b74b5560e.exe 29 PID 2692 wrote to memory of 2304 2692 6644075ef4ba5b9126bb275b74b5560e.exe 29 PID 2692 wrote to memory of 2304 2692 6644075ef4ba5b9126bb275b74b5560e.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6644075ef4ba5b9126bb275b74b5560e.exe"C:\Users\Admin\AppData\Local\Temp\6644075ef4ba5b9126bb275b74b5560e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"2⤵
- Executes dropped EXE
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD554ab761c01ac85ac6c389200f729f7d7
SHA1a38149840342b88b1bb598e5a486d4e31e1f9935
SHA2566804a7df737631105e1572ca296412f7ac054933ae867329ae9a08027fe953ef
SHA512b2c55ff6e366f695517edb8fa00b39710e25f365f7afdcf9663dbe6d09fdbe77f3face28ffc5ddbc48061a20340c24e082d630af63dff5dbbf6c3463276ea460