Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 23:01
Static task
static1
Behavioral task
behavioral1
Sample
97d59d2fb960923291014f64c2679545.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
97d59d2fb960923291014f64c2679545.exe
Resource
win10v2004-20231215-en
General
-
Target
97d59d2fb960923291014f64c2679545.exe
-
Size
82KB
-
MD5
97d59d2fb960923291014f64c2679545
-
SHA1
5bad8889e3fa82dbe4761fce64bba8d9b7532005
-
SHA256
b9daa860c407d626a8a5133dd4cfed76a403e3913203beec13bba35c0b161905
-
SHA512
9c732b444fef5fe2c7f5f5129d22e64e598da734eeceecb80f089be76dceaa33925b300bdb584454e17ad73e836590e8e0e0109ab22126abd971371aa299ea78
-
SSDEEP
1536:yvo7ZWMzyCOt2rKopl4mrxSf92q2ngRYwEsDCf8r:yvo7Zty7qXrrWd2gRpEKx
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2764 97d59d2fb960923291014f64c2679545.exe -
Executes dropped EXE 1 IoCs
pid Process 2764 97d59d2fb960923291014f64c2679545.exe -
Loads dropped DLL 1 IoCs
pid Process 2096 97d59d2fb960923291014f64c2679545.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2096 97d59d2fb960923291014f64c2679545.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2096 97d59d2fb960923291014f64c2679545.exe 2764 97d59d2fb960923291014f64c2679545.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2764 2096 97d59d2fb960923291014f64c2679545.exe 29 PID 2096 wrote to memory of 2764 2096 97d59d2fb960923291014f64c2679545.exe 29 PID 2096 wrote to memory of 2764 2096 97d59d2fb960923291014f64c2679545.exe 29 PID 2096 wrote to memory of 2764 2096 97d59d2fb960923291014f64c2679545.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\97d59d2fb960923291014f64c2679545.exe"C:\Users\Admin\AppData\Local\Temp\97d59d2fb960923291014f64c2679545.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\97d59d2fb960923291014f64c2679545.exeC:\Users\Admin\AppData\Local\Temp\97d59d2fb960923291014f64c2679545.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2764
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD591629414d9a90aff69e8321e95631057
SHA14444af51048fba279c4e1c5740a353267bb46639
SHA2567b0e18ef61bb1ab42b5c0d5b4cdd1a9e717b9572552c90931ca9dff0dd0ecb25
SHA512e9cbddeb008df4da607716524d33b1988416a194f54571f5f531c3392f7b1b1eb3cb5135a20841ffdb1e84cec54db5da2fa771ba3a42285e7c840c778cc041dc