Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 17:28
Static task
static1
Behavioral task
behavioral1
Sample
6836c4e3ce82e8d65bf79b802613ea5b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6836c4e3ce82e8d65bf79b802613ea5b.exe
Resource
win10v2004-20231215-en
General
-
Target
6836c4e3ce82e8d65bf79b802613ea5b.exe
-
Size
86KB
-
MD5
6836c4e3ce82e8d65bf79b802613ea5b
-
SHA1
2425dfd751f1194b7c9d44bac6b33a82f6200854
-
SHA256
3e52449ca7b4df018a6d8ff7404b10d81d31030dcebabe4f86b0e7504c905782
-
SHA512
ab0797233317a15413f3b1c722ce1d0c58cb9203a123c04442fd9f589b14ca5420cf9629607c580e059693968f731180aa01cb9bfff7c5f78f980bfab4c9e8e0
-
SSDEEP
1536:A/bftSpkWBNHZpS5JoNAj/wpF2sS+LSBwglQgdrE8qpo9oWDEihHFLl11EzSzbWp:A/LFY5pyJoNo/GrSzwFgXqpo9N3LTeWs
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2664 cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\spool\PRTPROCS\x64\GRO1.tmp 6836c4e3ce82e8d65bf79b802613ea5b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2664 1308 6836c4e3ce82e8d65bf79b802613ea5b.exe 28 PID 1308 wrote to memory of 2664 1308 6836c4e3ce82e8d65bf79b802613ea5b.exe 28 PID 1308 wrote to memory of 2664 1308 6836c4e3ce82e8d65bf79b802613ea5b.exe 28 PID 1308 wrote to memory of 2664 1308 6836c4e3ce82e8d65bf79b802613ea5b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6836c4e3ce82e8d65bf79b802613ea5b.exe"C:\Users\Admin\AppData\Local\Temp\6836c4e3ce82e8d65bf79b802613ea5b.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\cmd.execmd /c "file.bat"2⤵
- Deletes itself
PID:2664
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179B
MD5d3922d14e2fec71d958e35af679a9abf
SHA10649ed68c4f0a55096b3cb8ab0736d4fafbf4957
SHA2564f563af0efc46db9b1d2a1dad7a391641a6cbd66cfd1093dd6f6de18bd36299a
SHA5125331308a77599d71fa54938e3af125e689ef24ad3357eacf3863bdea37a80852e27bdfdfa0b9ae34cba7e9b93b745c6b6847d50770e5320187aafce911c1ca0d