Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/01/2024, 04:36
Behavioral task
behavioral1
Sample
7666631340601c748c0b9cb8affa02db.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7666631340601c748c0b9cb8affa02db.exe
Resource
win10v2004-20231215-en
General
-
Target
7666631340601c748c0b9cb8affa02db.exe
-
Size
5.8MB
-
MD5
7666631340601c748c0b9cb8affa02db
-
SHA1
b463ac7a8b4eea1e5a48b0170a6a15e70c390e25
-
SHA256
fa0a9ee26d02a444c2eb0f05449f74ccf1ae4b96988576e640014db33018df97
-
SHA512
1df46294d7f989aa9735a9cd16b3559797a3ce7c6e2a9f1f7e7952a6a8ef730860aab082bb2680986670c2f22a514511dc129397b8f9d978e00acc25bbe5499d
-
SSDEEP
98304:85mdM5JhLlvFhiY1gg3gnl/IVUs1jePsfk9AIE9GWiWDDPbkUwcgg3gnl/IVUs1h:Ip5dvntDgl/iBiP+k9AeWUUwYgl/iBiP
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3032 7666631340601c748c0b9cb8affa02db.exe -
Executes dropped EXE 1 IoCs
pid Process 3032 7666631340601c748c0b9cb8affa02db.exe -
Loads dropped DLL 1 IoCs
pid Process 1948 7666631340601c748c0b9cb8affa02db.exe -
resource yara_rule behavioral1/memory/1948-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral1/files/0x00080000000120f8-10.dat upx behavioral1/files/0x00080000000120f8-13.dat upx behavioral1/memory/3032-17-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1948 7666631340601c748c0b9cb8affa02db.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1948 7666631340601c748c0b9cb8affa02db.exe 3032 7666631340601c748c0b9cb8affa02db.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 3032 1948 7666631340601c748c0b9cb8affa02db.exe 28 PID 1948 wrote to memory of 3032 1948 7666631340601c748c0b9cb8affa02db.exe 28 PID 1948 wrote to memory of 3032 1948 7666631340601c748c0b9cb8affa02db.exe 28 PID 1948 wrote to memory of 3032 1948 7666631340601c748c0b9cb8affa02db.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7666631340601c748c0b9cb8affa02db.exe"C:\Users\Admin\AppData\Local\Temp\7666631340601c748c0b9cb8affa02db.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\7666631340601c748c0b9cb8affa02db.exeC:\Users\Admin\AppData\Local\Temp\7666631340601c748c0b9cb8affa02db.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
309KB
MD53352097531ad9625aeb90d832f189d6c
SHA14f6b51c6d2c8a04dc5609f6856d25ef4c06a2ea2
SHA2563a2b935531cba2f11eee82393a646c8a677c7a25d8fe0934a0082bba8092a3d0
SHA512e5f243edfcecad16d1e16fbf234023f97d88837f379f3c914f863f4eb6a59bfd437ad430f8f8dda533c1c927b7417c223ac3a9bbf2280d4c94126cc8d9195472
-
Filesize
573KB
MD5cb8e833a760d6a63dc30e282cf2f00b7
SHA11699549b4960eb930c879aa8c50874f6535457a6
SHA256c5c3992bcb97b76938ecc5fcae3a7c5940b5745065e3ed788c42db08d22d7bbf
SHA51234169fb59e192aa3f618790348c56e2f5908ab29c797833d7589c2c0891b66a98ed02e9be2d60b2adcc61f6928d5adcf488ce80628ac0990d4ff8b67b8753dc5