Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 00:16
Behavioral task
behavioral1
Sample
ad37ae21c2afca94f45c12d8d9b9311f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad37ae21c2afca94f45c12d8d9b9311f.exe
Resource
win10v2004-20240226-en
General
-
Target
ad37ae21c2afca94f45c12d8d9b9311f.exe
-
Size
1.3MB
-
MD5
ad37ae21c2afca94f45c12d8d9b9311f
-
SHA1
bc2fe0fab4b0366040ceac0df075f5db926b2811
-
SHA256
e6f56347c18c8b8a0e096e30a40af1bb2495078454a2941aa843b703c150cacd
-
SHA512
cccea7a967609632e64823bcbe8cb987eb8e363861984f84af8da247c23e519117b1095af083d68bd7591df9dbab7f961add2bcb73f05b5a90fd9c7de2c4994e
-
SSDEEP
24576:DcQKjrFcI+TvLYCEbd343McTSBAkpOYbauALvttFiv5JPS8Z4EELCCBlcvG:GjrFc3bEW3McWWkJbF+oc8aEEdBl
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2896 ad37ae21c2afca94f45c12d8d9b9311f.exe -
Executes dropped EXE 1 IoCs
pid Process 2896 ad37ae21c2afca94f45c12d8d9b9311f.exe -
Loads dropped DLL 1 IoCs
pid Process 2468 ad37ae21c2afca94f45c12d8d9b9311f.exe -
resource yara_rule behavioral1/memory/2468-0-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral1/files/0x0006000000012247-11.dat upx behavioral1/memory/2896-17-0x0000000000400000-0x000000000086A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2468 ad37ae21c2afca94f45c12d8d9b9311f.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2468 ad37ae21c2afca94f45c12d8d9b9311f.exe 2896 ad37ae21c2afca94f45c12d8d9b9311f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2896 2468 ad37ae21c2afca94f45c12d8d9b9311f.exe 28 PID 2468 wrote to memory of 2896 2468 ad37ae21c2afca94f45c12d8d9b9311f.exe 28 PID 2468 wrote to memory of 2896 2468 ad37ae21c2afca94f45c12d8d9b9311f.exe 28 PID 2468 wrote to memory of 2896 2468 ad37ae21c2afca94f45c12d8d9b9311f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad37ae21c2afca94f45c12d8d9b9311f.exe"C:\Users\Admin\AppData\Local\Temp\ad37ae21c2afca94f45c12d8d9b9311f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\ad37ae21c2afca94f45c12d8d9b9311f.exeC:\Users\Admin\AppData\Local\Temp\ad37ae21c2afca94f45c12d8d9b9311f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2896
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD551137222d3adef4b7afa9b1269f01f88
SHA1ed489b3cff5639ed2833559cf35bde9f7160568b
SHA256860bc1bc1e30820a88341d26e78d1a4e3234df72556fbc371c8409ba7412f02c
SHA51238ecf2b482bb4d35cde10443d01818fe8a6a1a4cd18ab2bb4f577eeec4a58049711ba8eb7adf16a8208d21fc47befab6a5a05f1d5e9b93cb7e1b472e8a9dc91b