Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 07:09
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Hoax.Win32.Agent.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
HEUR-Hoax.Win32.Agent.exe
Resource
win10v2004-20240226-en
General
-
Target
HEUR-Hoax.Win32.Agent.exe
-
Size
74KB
-
MD5
315f656693fa75d0eb56d5da132ef892
-
SHA1
96b7ea4bbb81000293d4a117f9391395ced1e3c2
-
SHA256
186856976bb027537da0f421c1505a84faf5cf5d96734730085da9ea74c9d2f5
-
SHA512
9eae86aa2a06fc76dab491b6f60603b2ced9872915ceca295f0a3c41e2035dc6ade32bef9dd07b49ea5113d7320b1e24b4fb9163aae2e5094235d28955022555
-
SSDEEP
1536:Uj1Tzy48untU8fOMEI3jyYfYiuOjxnCaZ:UhzltUeOsHRJCU
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1708 2380 HEUR-Hoax.Win32.Agent.exe 29 PID 2380 wrote to memory of 1708 2380 HEUR-Hoax.Win32.Agent.exe 29 PID 2380 wrote to memory of 1708 2380 HEUR-Hoax.Win32.Agent.exe 29 PID 2380 wrote to memory of 1708 2380 HEUR-Hoax.Win32.Agent.exe 29 PID 1708 wrote to memory of 2540 1708 cmd.exe 30 PID 1708 wrote to memory of 2540 1708 cmd.exe 30 PID 1708 wrote to memory of 2540 1708 cmd.exe 30 PID 1708 wrote to memory of 2540 1708 cmd.exe 30 PID 2540 wrote to memory of 3044 2540 iexpress.exe 31 PID 2540 wrote to memory of 3044 2540 iexpress.exe 31 PID 2540 wrote to memory of 3044 2540 iexpress.exe 31 PID 2540 wrote to memory of 3044 2540 iexpress.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Hoax.Win32.Agent.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Hoax.Win32.Agent.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\142C.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\HEUR-Hoax.Win32.Agent.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:3044
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
74KB
MD54459bb6923f7b579151a85f6366880ba
SHA1f6c36a08d2df946e5024f1aa4356e5cdd5f630e3
SHA256f62285180ff65c4953380c5fe6dcac0be83264f2257e0ef976f0870b099edd4c
SHA512cc6f3c0276d8f58efa4aa0cf445e9025a5a15e324cea088568185f77287a86a7ca94a8168802ebb0596203f656f3ac185cedc6839c19ce7489deaf455bf76e60
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083