Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
655c92c1d009d72803fb66f5c03d70a2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
655c92c1d009d72803fb66f5c03d70a2.exe
Resource
win10v2004-20231215-en
General
-
Target
655c92c1d009d72803fb66f5c03d70a2.exe
-
Size
2.3MB
-
MD5
655c92c1d009d72803fb66f5c03d70a2
-
SHA1
de9aa234985e13190fce487d3f047f43179411f5
-
SHA256
051e2bfa89d4dc3a7811d17bcac048cbc764020dc52c5645bc5021d740ef0fb4
-
SHA512
d370548ca102a898276dbbb05bf7595dd7ee09b56edd87d1e5f127f018f710dcc4483de74d8020af0aa0d344b6e170be8e4a412047f9821023724ba630d76ad6
-
SSDEEP
49152:NqSHvOJD8IfSEtYNHXm2vgfMkk6w/swJhj8ebA5rOYiZnr:YLelaYYP+RJhAebSivZnr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2160 655c92c1d009d72803fb66f5c03d70a2.tmp -
Loads dropped DLL 4 IoCs
pid Process 2040 655c92c1d009d72803fb66f5c03d70a2.exe 2160 655c92c1d009d72803fb66f5c03d70a2.tmp 2160 655c92c1d009d72803fb66f5c03d70a2.tmp 2160 655c92c1d009d72803fb66f5c03d70a2.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2160 655c92c1d009d72803fb66f5c03d70a2.tmp 2160 655c92c1d009d72803fb66f5c03d70a2.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2160 655c92c1d009d72803fb66f5c03d70a2.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2160 2040 655c92c1d009d72803fb66f5c03d70a2.exe 28 PID 2040 wrote to memory of 2160 2040 655c92c1d009d72803fb66f5c03d70a2.exe 28 PID 2040 wrote to memory of 2160 2040 655c92c1d009d72803fb66f5c03d70a2.exe 28 PID 2040 wrote to memory of 2160 2040 655c92c1d009d72803fb66f5c03d70a2.exe 28 PID 2040 wrote to memory of 2160 2040 655c92c1d009d72803fb66f5c03d70a2.exe 28 PID 2040 wrote to memory of 2160 2040 655c92c1d009d72803fb66f5c03d70a2.exe 28 PID 2040 wrote to memory of 2160 2040 655c92c1d009d72803fb66f5c03d70a2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\655c92c1d009d72803fb66f5c03d70a2.exe"C:\Users\Admin\AppData\Local\Temp\655c92c1d009d72803fb66f5c03d70a2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\is-1KOV3.tmp\655c92c1d009d72803fb66f5c03d70a2.tmp"C:\Users\Admin\AppData\Local\Temp\is-1KOV3.tmp\655c92c1d009d72803fb66f5c03d70a2.tmp" /SL5="$70124,1736876,70144,C:\Users\Admin\AppData\Local\Temp\655c92c1d009d72803fb66f5c03d70a2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84B
MD57ccd5a0af4da51cf4962f184fcf9456a
SHA1de37f4521fa7fee49b37898f4136728e8971ee0f
SHA2568f2374b30622dfae1fd0b9706520de34c5e1597c1531fddbff65bc0201132ac7
SHA512d7c4fbc6a4413dc457400fa2e026dea5d639a5b413164cc6939284c46bb46b6ae8ff10184ba2da4f32ace89646b026400db2a49dd9894d71e88d003a91c8267a
-
Filesize
44B
MD5176f5cbf0529c770f43dec8ca48c075f
SHA112cabe53c896c4f0b49c8a65b9c823e2e748314f
SHA25671e99ac4087d08ccacf8fcfe8a3103d5f8b2cc8b871accdd927eb7d8d00c7893
SHA512db2e2a859c88d62464759711070d3e1197ac1a7ef83fc1bf962b2ce170c49cc33580b8cd99726852d0744601343fc90a4d2d71427f80b2f50429994ec2955961
-
Filesize
164B
MD5adc799ec79eeaef366ea4dddf099c3ae
SHA1556c915615a34a2499604b7b732ab304b20fdd4e
SHA2567e7f18c73560f9c020abe1ab1f22705083281e2ea16ab0030fc927901b5b5d1e
SHA51276962a17cc26d3f9886828be4e43373ac530165e1c627272ed7c0bc731133e97608e55d2e31f44592aad0d0974352155f41a0718aa0666ec128406b1050c1d6c
-
Filesize
1.2MB
MD5e7106fbf42fbc6d5b08a18ada4f781b4
SHA136d4a629f79d772c0b0df8bd2ae2ea09108d239d
SHA25664e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635
SHA512adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845
-
Filesize
183KB
MD5db25dfdd4c1f2b65c68a230881072695
SHA194cd6a3438041f0e61b0a1bea7b66461854efe69
SHA2561b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73
SHA512db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3