Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 18:30
Behavioral task
behavioral1
Sample
b5618a9e6519d22db36eb1ea44f40373.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b5618a9e6519d22db36eb1ea44f40373.exe
Resource
win10v2004-20240226-en
General
-
Target
b5618a9e6519d22db36eb1ea44f40373.exe
-
Size
11.7MB
-
MD5
b5618a9e6519d22db36eb1ea44f40373
-
SHA1
f89900643e793d4564e22087421ce02352d1dc5f
-
SHA256
1998e7352e4dabdac62aed98c010c7635722e55096a4250ccac9993618edd304
-
SHA512
008008341407e9666bc54116e20bbd288c5dd7ce69c4cd79c7fe70cb4fc0f74e0800b9b23ec1a2807fc0486c2caca7ab2a1fa8f97e9606d3769cd94bf5c5d2ca
-
SSDEEP
196608:GJYlZCgl/iBiPIWI3gl/iBiPrcgl/iBiPIWI3gl/iBiP:IYnC2ix32ij2ix32i
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2944 b5618a9e6519d22db36eb1ea44f40373.exe -
Executes dropped EXE 1 IoCs
pid Process 2944 b5618a9e6519d22db36eb1ea44f40373.exe -
Loads dropped DLL 1 IoCs
pid Process 2972 b5618a9e6519d22db36eb1ea44f40373.exe -
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral1/files/0x000a00000001224c-10.dat upx behavioral1/memory/2944-14-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2972 b5618a9e6519d22db36eb1ea44f40373.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2972 b5618a9e6519d22db36eb1ea44f40373.exe 2944 b5618a9e6519d22db36eb1ea44f40373.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2972 wrote to memory of 2944 2972 b5618a9e6519d22db36eb1ea44f40373.exe 28 PID 2972 wrote to memory of 2944 2972 b5618a9e6519d22db36eb1ea44f40373.exe 28 PID 2972 wrote to memory of 2944 2972 b5618a9e6519d22db36eb1ea44f40373.exe 28 PID 2972 wrote to memory of 2944 2972 b5618a9e6519d22db36eb1ea44f40373.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5618a9e6519d22db36eb1ea44f40373.exe"C:\Users\Admin\AppData\Local\Temp\b5618a9e6519d22db36eb1ea44f40373.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\b5618a9e6519d22db36eb1ea44f40373.exeC:\Users\Admin\AppData\Local\Temp\b5618a9e6519d22db36eb1ea44f40373.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2944
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.7MB
MD590c6607995e955ddefe8a7720cbd82da
SHA150c1618dee954ca3284d0e5ea06d184c1c78ac4e
SHA2562a4dc51a200399b1dfb9ff84d195d1cb0f38aca9db3c616c2664a5a38384b859
SHA512d3af40ceb1acead1b35bbb65b0a96b084ef1b422287970fadb3101ca3fb53959b6fc8945e93404df4ba1d443640d59eed3b7388d9530aac6428a92bd27bf35e2