Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
8b042d76027198f7aa0a09b6385a8a28.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8b042d76027198f7aa0a09b6385a8a28.exe
Resource
win10v2004-20231222-en
General
-
Target
8b042d76027198f7aa0a09b6385a8a28.exe
-
Size
202KB
-
MD5
8b042d76027198f7aa0a09b6385a8a28
-
SHA1
118abd315b4395c13aeba304288afbe16f8cef4a
-
SHA256
498fbec78629442191b992a7dc25e17c946ff0c18a46dc450905743e60149b4e
-
SHA512
13828f392ac26388a64311e6bc001ea232420700fe43093dcfb9a680428252c0449fbd188bbfd71c19e547f6e9c64d328425b069e99f10d59fccd00f7b40f23c
-
SSDEEP
6144:5ZuuObR8sVImcyYC5JpWJj+pDswSrFuSaHZ5:WV+mzFfsFuRZ5
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2668 11.exe 2696 xcacls.exe 1384 xcacls.exe -
Loads dropped DLL 6 IoCs
pid Process 2084 8b042d76027198f7aa0a09b6385a8a28.exe 2084 8b042d76027198f7aa0a09b6385a8a28.exe 2780 cmd.exe 2780 cmd.exe 2780 cmd.exe 2780 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2668 2084 8b042d76027198f7aa0a09b6385a8a28.exe 28 PID 2084 wrote to memory of 2668 2084 8b042d76027198f7aa0a09b6385a8a28.exe 28 PID 2084 wrote to memory of 2668 2084 8b042d76027198f7aa0a09b6385a8a28.exe 28 PID 2084 wrote to memory of 2668 2084 8b042d76027198f7aa0a09b6385a8a28.exe 28 PID 2668 wrote to memory of 2780 2668 11.exe 29 PID 2668 wrote to memory of 2780 2668 11.exe 29 PID 2668 wrote to memory of 2780 2668 11.exe 29 PID 2668 wrote to memory of 2780 2668 11.exe 29 PID 2780 wrote to memory of 2696 2780 cmd.exe 31 PID 2780 wrote to memory of 2696 2780 cmd.exe 31 PID 2780 wrote to memory of 2696 2780 cmd.exe 31 PID 2780 wrote to memory of 2696 2780 cmd.exe 31 PID 2780 wrote to memory of 1384 2780 cmd.exe 32 PID 2780 wrote to memory of 1384 2780 cmd.exe 32 PID 2780 wrote to memory of 1384 2780 cmd.exe 32 PID 2780 wrote to memory of 1384 2780 cmd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b042d76027198f7aa0a09b6385a8a28.exe"C:\Users\Admin\AppData\Local\Temp\8b042d76027198f7aa0a09b6385a8a28.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\11.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\11.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt8681.bat3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xcacls.exexcacls d:\autorun.inf /p guest:n /y4⤵
- Executes dropped EXE
PID:2696
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\xcacls.exexcacls e:\autorun.inf /p guest:n /y4⤵
- Executes dropped EXE
PID:1384
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89B
MD5845d151578b0a924f1193a8155084c60
SHA1eabe0b36e4947ecf92f917bd8a299ad3c0a11689
SHA256ba992c56e0fe8d403d4cff1ff9e9e63569ef745f9476e1d6328a908a4a084d3e
SHA5129827f81a4b70df2934c880b271fe3222a9df6515d7e3231b181dd228636006d25bf51a8b0dbe693949e080dd78a8cc1141a5113b955912a7abce87dc53bcb3e4
-
Filesize
146KB
MD553f51af27da371c837bd4397324d0038
SHA1c0e82e388ee517f22ed7fa2b7ddfecde7d388c8d
SHA2568deae5fcc35dd450570df75ec1f9cc3c2f5f4b8a5b8e39ac4521d492dfcd8173
SHA512dd9dcfbf6db201551e18438ed8b450824a142d15d63ec64c015b316af77ddbdb35c21b9d1cb03cd70cd7654eaa85c8a141401031b4fc1422c49e4b1c5b3b6720
-
Filesize
89KB
MD598f2272a7d1ba8e3155fbea167bcc613
SHA15315e172dd1f431a5c70efa28e2960344190a3e9
SHA25629dce15201d8216ad847275ed8476699cd23ed48109f5362da321094d1327fef
SHA51248cca17665832a8df00997eb9c689204b052ffb9d92db8c6d418223f4fc830833e01b99e1ef08a2f245b6d327d64f742754a1cb5a974ac55d05b7cfe051c17e4