Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 09:22
Static task
static1
Behavioral task
behavioral1
Sample
7cbff1a4bbc061e3feef7b6aac2cb199.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7cbff1a4bbc061e3feef7b6aac2cb199.exe
Resource
win10v2004-20231222-en
General
-
Target
7cbff1a4bbc061e3feef7b6aac2cb199.exe
-
Size
221KB
-
MD5
7cbff1a4bbc061e3feef7b6aac2cb199
-
SHA1
2da62197957675d9b643b2f233837602a6b16913
-
SHA256
b40f12af5c52a4b36b16d7bc02631435074420deb06ac7c01c130ca9b8828237
-
SHA512
b47c57d9a62a74e80d1dccbd189b0fdb8c905047f9f2fa365d5558d4249f678fa5884921aa3d7bdf0276302897a3a2c4c461ed665a0eb24d9b7d9f56dee273ca
-
SSDEEP
3072:7I/mS4PL5AcHRW14UZm5TqeNm32egD5Bazp67bOhzI:7I/85/MWUQxh95Bag7b
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1988 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1988 1072 7cbff1a4bbc061e3feef7b6aac2cb199.exe 28 PID 1072 wrote to memory of 1988 1072 7cbff1a4bbc061e3feef7b6aac2cb199.exe 28 PID 1072 wrote to memory of 1988 1072 7cbff1a4bbc061e3feef7b6aac2cb199.exe 28 PID 1072 wrote to memory of 1988 1072 7cbff1a4bbc061e3feef7b6aac2cb199.exe 28 PID 1072 wrote to memory of 1988 1072 7cbff1a4bbc061e3feef7b6aac2cb199.exe 28 PID 1072 wrote to memory of 1988 1072 7cbff1a4bbc061e3feef7b6aac2cb199.exe 28 PID 1072 wrote to memory of 1988 1072 7cbff1a4bbc061e3feef7b6aac2cb199.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cbff1a4bbc061e3feef7b6aac2cb199.exe"C:\Users\Admin\AppData\Local\Temp\7cbff1a4bbc061e3feef7b6aac2cb199.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c "C:\Users\Admin\AppData\Local\Temp\Lpv..bat" > nul 2> nul2⤵
- Deletes itself
PID:1988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
210B
MD53e15c48abc6403be0c76f43cd744fb9f
SHA14d9156e1411cd8e8a9a133a0ead07aa8bdf3bc6c
SHA25640b933e775dcd99656b998b49f198c5cba13064e61a78ecbc84cf884ec865253
SHA512b1a9421fe6ddfb64164786248e7750bb336322673dfb20ec6d63b118bb98b55d2d66475ff2b4ba1de89c4db93c386abcea1782c3702b390fd360b8c95f8353d6