Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 07:03
Behavioral task
behavioral1
Sample
7409394d083b7d32b8cb4b666afea0e7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7409394d083b7d32b8cb4b666afea0e7.exe
Resource
win10v2004-20231215-en
General
-
Target
7409394d083b7d32b8cb4b666afea0e7.exe
-
Size
56KB
-
MD5
7409394d083b7d32b8cb4b666afea0e7
-
SHA1
52c2a2af66206568c3f328a6c4889ca0f7125eb4
-
SHA256
beeb7ad74a65ea26f610573216e7c6c9c817abc350e6ca7aafedc264f88e33e3
-
SHA512
102fd81ff9d79b67951a2adaede6731e38c3a820ff4dc6cedb989f010d5e983ec2e852838d7e21d78f990519cf59b1c6e94b5acd9bf031a7fbc904d3988343a7
-
SSDEEP
768:W2tLILuITEgXVwp0kIqj4A0tm4iqL2iU1veGDtspAORabJ0cBAZOibjDXNG+TRgF:bIqnSw+kIXAyCXOpEJ7BOrDTTmS2
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1724 7409394d083b7d32b8cb4b666afea0e7.exe -
Executes dropped EXE 1 IoCs
pid Process 1724 7409394d083b7d32b8cb4b666afea0e7.exe -
Loads dropped DLL 1 IoCs
pid Process 1140 7409394d083b7d32b8cb4b666afea0e7.exe -
resource yara_rule behavioral1/memory/1140-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000a000000012243-10.dat upx behavioral1/files/0x000a000000012243-16.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1140 7409394d083b7d32b8cb4b666afea0e7.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1140 7409394d083b7d32b8cb4b666afea0e7.exe 1724 7409394d083b7d32b8cb4b666afea0e7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1724 1140 7409394d083b7d32b8cb4b666afea0e7.exe 29 PID 1140 wrote to memory of 1724 1140 7409394d083b7d32b8cb4b666afea0e7.exe 29 PID 1140 wrote to memory of 1724 1140 7409394d083b7d32b8cb4b666afea0e7.exe 29 PID 1140 wrote to memory of 1724 1140 7409394d083b7d32b8cb4b666afea0e7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7409394d083b7d32b8cb4b666afea0e7.exe"C:\Users\Admin\AppData\Local\Temp\7409394d083b7d32b8cb4b666afea0e7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\7409394d083b7d32b8cb4b666afea0e7.exeC:\Users\Admin\AppData\Local\Temp\7409394d083b7d32b8cb4b666afea0e7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1724
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD51f29ffa94f0605323a93171987e63fdd
SHA10256f80fee725f87d3142ecfe1fe374f6203858d
SHA25676f5cdb560e3866cea78248a8b41b8b8371b0f467c767bc753c202d23c49d967
SHA5126da34876db50cb072fc40c326ee86838a85067e404e1bedb53f09ef68e81e76c2e533289350af662c68703b7be007fba01bd97f99d56f9c8eeff2dadb245156b