Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
24/02/2024, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
a1b6020d02d860d73c4bdcdce048f378.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a1b6020d02d860d73c4bdcdce048f378.exe
Resource
win10v2004-20240221-en
General
-
Target
a1b6020d02d860d73c4bdcdce048f378.exe
-
Size
209KB
-
MD5
a1b6020d02d860d73c4bdcdce048f378
-
SHA1
c5d5ed5802569b985730f0fd5e591bc3f7abe3e0
-
SHA256
5f6ca70c362f96c43ba6984ccff9269ecbcc3caeaa43da84cec632af88493728
-
SHA512
38fdb1fc990b13b5a3d53ed966c3079dd0ddd7197621b46c2c2a69c1a8a2d37ad4bd7a1a16bd434d3e83ec8154bacb35694e944676c9769c0c2238600b224add
-
SSDEEP
6144:+l0n6auJ+xcfsJyT+C4HT8Et4kVPEPmd5cfo:Zn6auJ4JnCMTrt1VPEPmq
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1428 u.dll 2584 u.dll 3036 mpress.exe -
Loads dropped DLL 6 IoCs
pid Process 2680 cmd.exe 2680 cmd.exe 2680 cmd.exe 2680 cmd.exe 2584 u.dll 2584 u.dll -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2680 1620 a1b6020d02d860d73c4bdcdce048f378.exe 29 PID 1620 wrote to memory of 2680 1620 a1b6020d02d860d73c4bdcdce048f378.exe 29 PID 1620 wrote to memory of 2680 1620 a1b6020d02d860d73c4bdcdce048f378.exe 29 PID 1620 wrote to memory of 2680 1620 a1b6020d02d860d73c4bdcdce048f378.exe 29 PID 2680 wrote to memory of 1428 2680 cmd.exe 30 PID 2680 wrote to memory of 1428 2680 cmd.exe 30 PID 2680 wrote to memory of 1428 2680 cmd.exe 30 PID 2680 wrote to memory of 1428 2680 cmd.exe 30 PID 2680 wrote to memory of 2584 2680 cmd.exe 31 PID 2680 wrote to memory of 2584 2680 cmd.exe 31 PID 2680 wrote to memory of 2584 2680 cmd.exe 31 PID 2680 wrote to memory of 2584 2680 cmd.exe 31 PID 2584 wrote to memory of 3036 2584 u.dll 32 PID 2584 wrote to memory of 3036 2584 u.dll 32 PID 2584 wrote to memory of 3036 2584 u.dll 32 PID 2584 wrote to memory of 3036 2584 u.dll 32 PID 2680 wrote to memory of 2852 2680 cmd.exe 33 PID 2680 wrote to memory of 2852 2680 cmd.exe 33 PID 2680 wrote to memory of 2852 2680 cmd.exe 33 PID 2680 wrote to memory of 2852 2680 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1b6020d02d860d73c4bdcdce048f378.exe"C:\Users\Admin\AppData\Local\Temp\a1b6020d02d860d73c4bdcdce048f378.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\B66.tmp\vir.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save a1b6020d02d860d73c4bdcdce048f378.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
PID:1428
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save ose00000.exe.com -include s.dll -overwrite -nodelete3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\26F1.tmp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\26F1.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe26F2.tmp"4⤵
- Executes dropped EXE
PID:3036
-
-
-
C:\Windows\SysWOW64\calc.exeCALC.EXE3⤵PID:2852
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55745d2e7b40b8cf0f0e4b9212dcd53a9
SHA14527b006f5d9afe570cbd92cf036de9ac1ed3408
SHA2561633b5f23c807ee9030e1d567655f7b475b053cb46692327454f753932dc0426
SHA5123770ce98f2e146a1a6f32928557ddebcf518d7df074b58cf98347d0dc76ba8e1dd3d5fd768d79621a2096aeb926a84841c0885a98d2f067d1e85a16a69633963
-
Filesize
24KB
MD57cda353434725a4a3712954fd3ded290
SHA1d8348e79d6bcee527743b126026367d700ddb436
SHA2567e781837fa89a8ead0a14c14a7f2125a89bb7b33d2ccc358f6b8ad22924b5e86
SHA5124ac257fe8e0772adc8aa1a2626153c473554c341c025959dd994100c43e2cec274e8a532e0c1b5c0ecdf463733d25a63767b995b731ce272b1c7a3ad0820b95d
-
Filesize
41KB
MD57aa367dca7be65e07b16bd69f06263e3
SHA1d447739251408f8e8490a9d307927bfbe41737ce
SHA256738bf50547320b0683af727ad6d430f2e7b83c846fe24f91527b7ee263bfa076
SHA512d7884589d7d12a628c9e07b77b3b793fa91f67fe13563e7b072ca864e053e6b7d711852e30ae1c877576b8ad47f67d2826e8ee711e6b65a329baa57492fe31b3
-
Filesize
700KB
MD53c9568b0d86a865f9f73d9c0967cfdad
SHA13270df3e0e600f4df2c3cbc384837693a8a3a83e
SHA256c7b97a001b39e17382e929aad924555f3d21886b86aed38cffd660490801d1d6
SHA512bd423d1d57823b1bf6db42aeec199aa93178a9317ead85b42b60e091aaf4f73ce721bc07fda4750e112c4dccb9d87e21d5793965da9d6e92b0c5bed92c26876f
-
Filesize
1KB
MD5dd2755b2fdbd8fe4e420ed1fe8afd168
SHA13c4f7d3f6ea9c68d6835c2b1d2c407bddc8971eb
SHA25656c40636e34b42e9ef6fb7626c5653b185ca3d8ef555e094bba6665b2b7cb2ac
SHA512508362fe168b5a6c46799b475a14365e0fbb0c8668532be7fec1ce0c9a88db693edc5585d47756c86b3096634f96bec97f602fc6b4c5b19c2fc6c57d7f665da1
-
Filesize
1KB
MD50da88cd99e692dcedcd04c95c1ff5367
SHA121f826886ef20382172f2586e9c902fb4235a5c6
SHA2564f4945c9525638e1106052cc7dfde4f2fd176ec99e910ea2b85d5dee7e897fd6
SHA5122c65dd48575ceaf60b031ba4d09be0d47a486bdab331f23b0358ccc19f83d3b6e3db4d704f19d5e280d8a58883195d6d4a0d2110d8a46d11d302949b2bfdfd98
-
Filesize
100KB
MD5e42b81b9636152c78ba480c1c47d3c7f
SHA166a2fca3925428ee91ad9df5b76b90b34d28e0f8
SHA2567c24c72439880e502be51da5d991b9b56a1af242b4eef4737f0f43b4a87546d2
SHA5124b2986106325c5c3fe11ab460f646d4740eb85252aa191f2b84e29901fac146d7a82e31c72d39c38a70277f78278621ee506d9da2681f5019cd64c7df85cff6e