Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/01/2024, 23:44
Behavioral task
behavioral1
Sample
855dd26864fce1126781de7dfcc4a2a0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
855dd26864fce1126781de7dfcc4a2a0.exe
Resource
win10v2004-20231215-en
General
-
Target
855dd26864fce1126781de7dfcc4a2a0.exe
-
Size
25.1MB
-
MD5
855dd26864fce1126781de7dfcc4a2a0
-
SHA1
6ee967de35558f3af1e8aed7c1e635da9274e856
-
SHA256
987a48d95eebabc64432eb3fd2b996127077db5d4a9f462573d451b04be91128
-
SHA512
2977f7bd9aeb36cd877ec264e1f80b688010ae0989f540693ec89b504386cbf7876cc59b830b300d4fe90e6a7b9e25f373f2d624fc6a0cbb2445a502be573994
-
SSDEEP
786432:VUchjCEDVfjrRj0r6+bUno0j4ILgtN35uA82wM:zjCYbr50rVOoSK5u7K
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1424 855dd26864fce1126781de7dfcc4a2a0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2756 wrote to memory of 1424 2756 855dd26864fce1126781de7dfcc4a2a0.exe 28 PID 2756 wrote to memory of 1424 2756 855dd26864fce1126781de7dfcc4a2a0.exe 28 PID 2756 wrote to memory of 1424 2756 855dd26864fce1126781de7dfcc4a2a0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\855dd26864fce1126781de7dfcc4a2a0.exe"C:\Users\Admin\AppData\Local\Temp\855dd26864fce1126781de7dfcc4a2a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\855dd26864fce1126781de7dfcc4a2a0.exe"C:\Users\Admin\AppData\Local\Temp\855dd26864fce1126781de7dfcc4a2a0.exe"2⤵
- Loads dropped DLL
PID:1424
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD51d5e4c20a20740f38f061bdf48aaca4f
SHA1de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0
SHA256f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366
SHA5129df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397