Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
ab519667dcfb48e1effa8a794187ae38.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ab519667dcfb48e1effa8a794187ae38.exe
Resource
win10v2004-20240226-en
General
-
Target
ab519667dcfb48e1effa8a794187ae38.exe
-
Size
150KB
-
MD5
ab519667dcfb48e1effa8a794187ae38
-
SHA1
ae73c96ac65af469bf9d22574a672e61edba11bc
-
SHA256
496a82d41ef981aaf95528eba07b68a8bbfafa567f3a1bdb10d600c629442fb5
-
SHA512
4d6b2bf78d29d89e625ee1bbe7789ad5ebc7de5bf373e8530fc7aa9f38f46127871a448a09a004a2ff7d04451122f05fb018906bef6aba67c3ed25a0d5e583d1
-
SSDEEP
3072:OPLRxVU5Cn0IKbuFEI1ZCM1PqG9pT632FszuZMrBls9jCAypKke3ZuYsERohNSkz:BCn0IMul2N7ZeJuY9hfZC
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
keyloggerdeneme
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2716 vpd.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2716 2256 ab519667dcfb48e1effa8a794187ae38.exe 28 PID 2256 wrote to memory of 2716 2256 ab519667dcfb48e1effa8a794187ae38.exe 28 PID 2256 wrote to memory of 2716 2256 ab519667dcfb48e1effa8a794187ae38.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab519667dcfb48e1effa8a794187ae38.exe"C:\Users\Admin\AppData\Local\Temp\ab519667dcfb48e1effa8a794187ae38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\vpd.com"C:\Users\Admin\AppData\Local\Temp\vpd.com"2⤵
- Executes dropped EXE
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD575e4fc3cfd146d8a84356f739616c856
SHA1191b0e3c596daef14d0aa5d003f9b6b9eea99f86
SHA2566c1006d566ff9ca3e3b5035ae8b8274647d613fcfcc9ca42a0b822b4649519c3
SHA51213990982e58f28facc2f8f8bc43750fc9f553c183af759039b22c3bc3bf7e5b9f62a43392a77541cc264bb98d8dca819904bc6c4b2e06fc841adcb6ae6a5f963
-
Filesize
74KB
MD59080b0dd4f555a49a787c8c92c78ca0f
SHA1c98cac8da3c198629c86efc9b477170a20062ad9
SHA2568689190f77397bebda4ccd1d399d34f7b85294192d94761b1f8bbfae98879f85
SHA512f8ee2ba83a83c3072c76c3f52de6abfb66b23dad1a242af4a9bf340342654813c704be75d4fc6cc82871fd1e450930cc9f41a6655896f07ca86c9380ec9afb82