Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
6504d042f8e452b67da0365221736a0b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6504d042f8e452b67da0365221736a0b.exe
Resource
win10v2004-20231215-en
General
-
Target
6504d042f8e452b67da0365221736a0b.exe
-
Size
244KB
-
MD5
6504d042f8e452b67da0365221736a0b
-
SHA1
cd26194dfedb3a3fd77d779d1b0812dd2ba84b79
-
SHA256
7bf8b9aa9c63656ddd1dc70a08814ca946d1fc140b2f6a0ba84e2ba9b05ae41e
-
SHA512
bf80d33c1abeaf293bd5358a1cdafecd3f63f4bf185cca5f0facf4ad8274959a03ec3e4b7734e91cf51365f6efa2f78296faa4f087d8b5b674d00463fb2e35b4
-
SSDEEP
6144:zOUj+bBvkSHQeZdz+654mE/vf9pd7ngyqhY:zOUj+bBDHLZdK6amE/NVcY
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2760 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2760 1204 6504d042f8e452b67da0365221736a0b.exe 28 PID 1204 wrote to memory of 2760 1204 6504d042f8e452b67da0365221736a0b.exe 28 PID 1204 wrote to memory of 2760 1204 6504d042f8e452b67da0365221736a0b.exe 28 PID 1204 wrote to memory of 2760 1204 6504d042f8e452b67da0365221736a0b.exe 28 PID 1204 wrote to memory of 2760 1204 6504d042f8e452b67da0365221736a0b.exe 28 PID 1204 wrote to memory of 2760 1204 6504d042f8e452b67da0365221736a0b.exe 28 PID 1204 wrote to memory of 2760 1204 6504d042f8e452b67da0365221736a0b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6504d042f8e452b67da0365221736a0b.exe"C:\Users\Admin\AppData\Local\Temp\6504d042f8e452b67da0365221736a0b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Fjz..bat" > nul 2> nul2⤵
- Deletes itself
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD59f76a4c00860017647ddf2837c1a9a33
SHA15e5ba10b10bd7a44a53738eb2de8c5c7fdb675c7
SHA256236d98fc44527691ce93ff7a2cdad51cfcba741c7c11c3f42760fd8231f74564
SHA51248329b420c725e67ca723d6c34058d8da2d73b32b7cd7d05b61bdce6b4459d350afb8febb66a59a7544aea33adf74d71edccd9944a373085732cddcdd2ed63b0