Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
99248b83997414598bdfa2a9277637cd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
99248b83997414598bdfa2a9277637cd.exe
Resource
win10v2004-20231222-en
General
-
Target
99248b83997414598bdfa2a9277637cd.exe
-
Size
2.0MB
-
MD5
99248b83997414598bdfa2a9277637cd
-
SHA1
9c81b9f98bb505bb41c7bf25d3cf8d6064b25613
-
SHA256
e9f5c225e16b57be0e4cd6d946283953a1bd17cbe30f018ed5a0964eb990dafa
-
SHA512
92ea4d08bc96e90a9663f72860a423582e45c3ee90eab37de67e1852b9d80456f2b1c40aa43bc03ef66a3987137d71bc7c1b70cd73a95807b5132a8e47d58864
-
SSDEEP
49152:e5O1BBm7dVsiOPd4U3hQvzBSmz2rv5Y/kwvv3:eeB0JCXd4UKCskwH
Malware Config
Signatures
-
Loads dropped DLL 53 IoCs
pid Process 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe 2780 99248b83997414598bdfa2a9277637cd.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created \??\c:\Program Files\baidubar\taobao.ico 99248b83997414598bdfa2a9277637cd.exe File created \??\c:\Program Files\baidubar\qidian.ico 99248b83997414598bdfa2a9277637cd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Filesize1KB
MD5ad9f301811fcdb34cd0663cd6ea4bb77
SHA15a16ee4bb156aa89fc0bf22c90114a0f3fcc30ab
SHA256ccb02baa5beab3a98c0a86642b66e4b58c56673c1569326fd8c0773add26d095
SHA51262ba1b701d598ad47349b4b1fd581fb39771cfbcf152fca72052ef9462caf15f2face566fd5cd00e4bb4936e5e7d49cd2e735605ecf8cdb8a124ff9fa002d556
-
Filesize
1KB
MD508297c1b75883cd5eec523f435df616d
SHA1745984b6f202d1ca0e975c97c4ab36d296f24b99
SHA256236397ce680623d3ca481b1a3f11b8535271eca868e9c6536e7b348cb4153acc
SHA512b9ffd2765f5b73cccbeaa0834ebac867fee2904d725ab2234ad7d6a6cbf1ea167894e234b8ea8c9e565cf22dc46a0824863dba29b97bed91925c97682b48e464
-
Filesize
1KB
MD50efe1829d835ecc46764832151fd2069
SHA16e2e5525797ea4f0eb94964e63670321d7c5bb12
SHA256f82ea98b1ffe870d287b22c41633694360f0b343fd7e50ae5d379c774464e92d
SHA51290c9d311c38af30162a3fee45038dc7eea101621dfab1eb7406eff8d51b0cc05eef51d97f5807f8b8e9d4813ce4ea755c322731c445ec446588256a3760c2201
-
Filesize
4KB
MD5073d44e11a4bcff06e72e1ebfe5605f7
SHA15f4e85ab7a1a636d95b50479a10bcb5583af93f3
SHA256b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb
SHA512e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667