Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 03:01
Behavioral task
behavioral1
Sample
a6c84ae5cc9431a89031a9f94fab93a4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
a6c84ae5cc9431a89031a9f94fab93a4.exe
Resource
win10v2004-20231215-en
General
-
Target
a6c84ae5cc9431a89031a9f94fab93a4.exe
-
Size
68KB
-
MD5
a6c84ae5cc9431a89031a9f94fab93a4
-
SHA1
7f4faeef976068d4b7cea3000c8285c2c2ac5d3f
-
SHA256
5255f3f64785427c2f29fdd178fa6b90e19a166baa1358dba5ece08c0d8341d9
-
SHA512
cab9f1da000e3f262665f0cc192f204cbee98a006013a9111f83161367209a7f079ca04a66adca80a0cc305c592d263a2390671c51701daa23fe55fe77dc33f3
-
SSDEEP
1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAvCbDa6J9:z6a+CdOOtEvwDpjQHT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2304 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2332 a6c84ae5cc9431a89031a9f94fab93a4.exe -
resource yara_rule behavioral1/memory/2332-1-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/files/0x000c0000000122f3-11.dat upx behavioral1/memory/2332-13-0x0000000001FA0000-0x0000000001FB0000-memory.dmp upx behavioral1/memory/2332-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2304-18-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2304-28-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2304 2332 a6c84ae5cc9431a89031a9f94fab93a4.exe 28 PID 2332 wrote to memory of 2304 2332 a6c84ae5cc9431a89031a9f94fab93a4.exe 28 PID 2332 wrote to memory of 2304 2332 a6c84ae5cc9431a89031a9f94fab93a4.exe 28 PID 2332 wrote to memory of 2304 2332 a6c84ae5cc9431a89031a9f94fab93a4.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6c84ae5cc9431a89031a9f94fab93a4.exe"C:\Users\Admin\AppData\Local\Temp\a6c84ae5cc9431a89031a9f94fab93a4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5d74644ad05df9fffd5db0b847ad5895f
SHA15ab8b4689a8bc77f9a20a6b525efdcf0ca4c3c3c
SHA256a55e3bd66bd9925bdb795f81c76642927522cd47a3890dbc07ab6ff9c0bbcebe
SHA512c1d20bf334e2c926978cf45adfadba803f3163356bcf2d6ce69986429e672755c0eea3192f07d7a3057bb1810e5c3f05d840b3fc37aa68b0bd57ed4486d5f1d0