Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 14:35
Behavioral task
behavioral1
Sample
8c93bc78e063cf801c46d533f3a6bb22.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8c93bc78e063cf801c46d533f3a6bb22.exe
Resource
win10v2004-20231215-en
General
-
Target
8c93bc78e063cf801c46d533f3a6bb22.exe
-
Size
5.8MB
-
MD5
8c93bc78e063cf801c46d533f3a6bb22
-
SHA1
a3c73cb29ddf3f0402cec7e726e43a49a02eea48
-
SHA256
13161689117efe2d0b9cf670eda148e17f9f3b4c612094f6c7da52c8d551b316
-
SHA512
27a01fd7e421d7d22506a162206174797eb44ee347037e60dac0a6bcaa45c9af443cab160a8b6d1db0b263813e66618068d30558beae732a77cd574b1de4831b
-
SSDEEP
98304:QlRJRAVMKJygg3gnl/IVUs1jePshe1r7baWgZBjw+gg3gnl/IVUs1jePs:QlRr1uWgl/iBiPYetu3Vgl/iBiP
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1132 8c93bc78e063cf801c46d533f3a6bb22.exe -
Executes dropped EXE 1 IoCs
pid Process 1132 8c93bc78e063cf801c46d533f3a6bb22.exe -
Loads dropped DLL 1 IoCs
pid Process 2732 8c93bc78e063cf801c46d533f3a6bb22.exe -
resource yara_rule behavioral1/memory/2732-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral1/files/0x000a000000013a1a-13.dat upx behavioral1/files/0x000a000000013a1a-10.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2732 8c93bc78e063cf801c46d533f3a6bb22.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2732 8c93bc78e063cf801c46d533f3a6bb22.exe 1132 8c93bc78e063cf801c46d533f3a6bb22.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 1132 2732 8c93bc78e063cf801c46d533f3a6bb22.exe 28 PID 2732 wrote to memory of 1132 2732 8c93bc78e063cf801c46d533f3a6bb22.exe 28 PID 2732 wrote to memory of 1132 2732 8c93bc78e063cf801c46d533f3a6bb22.exe 28 PID 2732 wrote to memory of 1132 2732 8c93bc78e063cf801c46d533f3a6bb22.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe"C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exeC:\Users\Admin\AppData\Local\Temp\8c93bc78e063cf801c46d533f3a6bb22.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1132
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
402KB
MD5d9f390655386fc4bf7e86660205488b3
SHA1b6d87514e82b058e8e301573bb494b88a4b802cc
SHA2569b8517a28d6acde3de773d2ec9900b14edf90075522de28ce1aa7eb7c14dfa23
SHA512ef8130ddcfe157a4d24ca00c7cd62a9cea89c973754701f120f35f31c85fa126bf5c0650e5ca5958d9ca62ef256282c6a49e1091a85516f09b2c3656a28441dc
-
Filesize
540KB
MD5d94513eaff94b0a7f5ee97e9724b5517
SHA161c0d5632e7bdef8fe0b2c3b6afbb5b02c9054db
SHA256a09700ee4fc598406df97fb3c932d04885a0a353965a90655f5ad4665b7bb470
SHA512f36602834fd088297a56ac6ca9174c20e56bc957cde05bf1e2be208fb82d91569ae01b57dab3d08ec608fbf24630bcc7fffe782a7c1d4d48d6e1054331d94ca6