Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 00:16
Static task
static1
Behavioral task
behavioral1
Sample
ad37f8d66b1a10016d3de3e6c2cd2a9c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad37f8d66b1a10016d3de3e6c2cd2a9c.exe
Resource
win10v2004-20240226-en
General
-
Target
ad37f8d66b1a10016d3de3e6c2cd2a9c.exe
-
Size
1.9MB
-
MD5
ad37f8d66b1a10016d3de3e6c2cd2a9c
-
SHA1
7f9b46d4221d74dde6db9e4ec06bf19e26f2e0f5
-
SHA256
88f11245b33e61a1dc87628701d35999850773dc81ee03b8be6bef1f87d79a37
-
SHA512
2c193930f30a22a52a09ba738a7f7671feb85e1bbaa6d09c238092c67646a6e58b68b42b2da88061600296158e473b6e7b64db02f746d4a44f4ace5e32833221
-
SSDEEP
49152:Qoa1taC070dp+o9tR/zu62/QrGR4xOEnT:Qoa1taC0wLdQSGmI2T
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2684 8BEB.tmp -
Executes dropped EXE 1 IoCs
pid Process 2684 8BEB.tmp -
Loads dropped DLL 1 IoCs
pid Process 1500 ad37f8d66b1a10016d3de3e6c2cd2a9c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2684 1500 ad37f8d66b1a10016d3de3e6c2cd2a9c.exe 28 PID 1500 wrote to memory of 2684 1500 ad37f8d66b1a10016d3de3e6c2cd2a9c.exe 28 PID 1500 wrote to memory of 2684 1500 ad37f8d66b1a10016d3de3e6c2cd2a9c.exe 28 PID 1500 wrote to memory of 2684 1500 ad37f8d66b1a10016d3de3e6c2cd2a9c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad37f8d66b1a10016d3de3e6c2cd2a9c.exe"C:\Users\Admin\AppData\Local\Temp\ad37f8d66b1a10016d3de3e6c2cd2a9c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp" --splashC:\Users\Admin\AppData\Local\Temp\ad37f8d66b1a10016d3de3e6c2cd2a9c.exe 031C1E4454AC21613E60D21B36FD4A95FBC0DE1B4FD5E13AB94CE8D3F770559641CB28DCE0A9796E00C109987D51EDDA200C3888397A84F356FA139DDBD27EF92⤵
- Deletes itself
- Executes dropped EXE
PID:2684
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD53eec20fa52fad0d40b771e0a2f3da0cc
SHA115064ade26cc01f9d78d887f20b97de5d8ce5d59
SHA2566b56d84edc377116ec83d2dfc19b7d7e2c158317a11a14fafebce5cd8e09ae65
SHA51284871b565e0442ed26efb951f199ce2b761bb7fb0703b98a3a3f2a5ba90adf650dfb886b36e87bf5ec28bb27094abd6b64543c40f21b088382df911e2fe9ec65