Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 05:50
Static task
static1
Behavioral task
behavioral1
Sample
73e53a7e55215cbdb2949e62360b00cb.exe
Resource
win7-20231215-en
General
-
Target
73e53a7e55215cbdb2949e62360b00cb.exe
-
Size
876KB
-
MD5
73e53a7e55215cbdb2949e62360b00cb
-
SHA1
dbc3e88ae415f720862d8038d321292456ced57e
-
SHA256
055e429f4027b269b5d1a39ce24b023620a6efbd101c788c0dbde7a68085b506
-
SHA512
50fac5ebe890c206a8a36780be53f798a9dc73e8b98d9c2a9881946abade9161e3fc0464776f4f8a9af02f3b7cbd0d87ae05c95abb4d6ae3b3b1b028241d111c
-
SSDEEP
24576:utMLKmtvPyHu7Utw4WIy9pNg4W7HM8gcN+2QHCPgy:EiKmHyOwtZp7s8dQa
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 1248 73e53a7e55215cbdb2949e62360b00cb.exe 1248 73e53a7e55215cbdb2949e62360b00cb.exe 1248 73e53a7e55215cbdb2949e62360b00cb.exe 1248 73e53a7e55215cbdb2949e62360b00cb.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 73e53a7e55215cbdb2949e62360b00cb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2444 wrote to memory of 1096 2444 73e53a7e55215cbdb2949e62360b00cb.exe 17 PID 2444 wrote to memory of 1096 2444 73e53a7e55215cbdb2949e62360b00cb.exe 17 PID 2444 wrote to memory of 1096 2444 73e53a7e55215cbdb2949e62360b00cb.exe 17 PID 2444 wrote to memory of 1096 2444 73e53a7e55215cbdb2949e62360b00cb.exe 17 PID 2444 wrote to memory of 1096 2444 73e53a7e55215cbdb2949e62360b00cb.exe 17 PID 2444 wrote to memory of 1096 2444 73e53a7e55215cbdb2949e62360b00cb.exe 17 PID 2444 wrote to memory of 1096 2444 73e53a7e55215cbdb2949e62360b00cb.exe 17 PID 1096 wrote to memory of 1248 1096 73e53a7e55215cbdb2949e62360b00cb.exe 16 PID 1096 wrote to memory of 1248 1096 73e53a7e55215cbdb2949e62360b00cb.exe 16 PID 1096 wrote to memory of 1248 1096 73e53a7e55215cbdb2949e62360b00cb.exe 16 PID 1096 wrote to memory of 1248 1096 73e53a7e55215cbdb2949e62360b00cb.exe 16 PID 1096 wrote to memory of 1248 1096 73e53a7e55215cbdb2949e62360b00cb.exe 16 PID 1096 wrote to memory of 1248 1096 73e53a7e55215cbdb2949e62360b00cb.exe 16 PID 1096 wrote to memory of 1248 1096 73e53a7e55215cbdb2949e62360b00cb.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\73e53a7e55215cbdb2949e62360b00cb.exe"C:\Users\Admin\AppData\Local\Temp\73e53a7e55215cbdb2949e62360b00cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\73e53a7e55215cbdb2949e62360b00cb.exe"C:\Users\Admin\AppData\Local\Temp\73e53a7e55215cbdb2949e62360b00cb.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1096
-
-
C:\Users\Admin\AppData\Local\Temp\73e53a7e55215cbdb2949e62360b00cb.exe"C:\Users\Admin\AppData\Local\Temp\73e53a7e55215cbdb2949e62360b00cb.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD50fe3ec85ca4953c1d108efb005e8aa29
SHA15455fc19a193bf5c7555b8a6610d626a8a672b39
SHA256203b007d8d29737b9626720b61bfe4afdd7297eab37169d0dc9544dd03fe2e46
SHA512652d3a0bfdc0936ed79a096fe527c3f7efa44bf6400db282d8a0bbc16dd8544c1ca974a5aec9fed4fb5e9f209a5423ff40e00891dba1c1f08ce075728a51d292
-
Filesize
5KB
MD544dac7f87bdf94d553f8d2cf073d605d
SHA121bf5d714b9fcab32ba40ff7d36e48c378b67a06
SHA2560e7dedad1360a808e7ab1086ff1fffa7b72f09475c07a6991b74a6c6b78ccf66
SHA51292c6bf81d514b3a07e7796843200a78c17969720776b03c0d347aeefedb8f1269f6aac642728a38544836c1f17c594d570718d11368dc91fe5194ee5e83e1774
-
Filesize
494KB
MD5f0c59526f8186eadaf2171b8fd2967c1
SHA18ffbe3e03d8139b50b41931c7b3360a0eebdb5cb
SHA2566e35d85fe4365e508adc7faffc4517c29177380c2ba420f02c2b9ee03103d3f6
SHA512dccd287c5f25cac346836e1140b743756178d01cd58539cf8fac12f7ae54d338bfb4364c650edb4d6018ef1f4065f7e9835d32fd608f8ae66c67a0ffd05e9854
-
Filesize
200KB
MD50d22cc1c033c0381a64186ecf745989b
SHA109dd49d229a4bf0699f4f3a5d8ad99438d81ba79
SHA256f51402d40f7848489a9989c81519132d2710c0907f4fcafec3d6cc96b9695597
SHA512bc1658760bb1ffe96f0a64baea0f39579c4a830d0a4db786f67dd0f886fda1197e5faf14df06245ec69a396da49be035ca52b6666392321d5b1776e7472b1d5c