Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
Resource
win10v2004-20240226-en
General
-
Target
423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
-
Size
202KB
-
MD5
3f26270f8b35747e0441c82d5ac8b1ea
-
SHA1
803a1c575e86e55fbc7d90f782cb3f3b6ac0b1bf
-
SHA256
423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71
-
SHA512
6ae3a5b45ba82b001ecdf22e83c3a77f6eb677172f0d8a3b5ec8e5a856e88978f86994575bd0fb21ace1a7353e596ab9d3bdef2aaf09e40e8ee2a3f2411601f4
-
SSDEEP
3072:l5o6RWcwC6BI70JkbfHUZIcKapBAE6i7UYF2FDgQGHhVvzP:3o6RWc40fzcniE/p2kQG7rP
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1912 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe -
Executes dropped EXE 1 IoCs
pid Process 1912 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe -
Loads dropped DLL 1 IoCs
pid Process 1152 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1152 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1912 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1912 1152 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe 29 PID 1152 wrote to memory of 1912 1152 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe 29 PID 1152 wrote to memory of 1912 1152 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe 29 PID 1152 wrote to memory of 1912 1152 423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe"C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exeC:\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1912
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\423a8f723c8ba5100855747c9de40d37e8cbaf53a3e5fe49d3cb1c673dbedd71.exe
Filesize202KB
MD5ad0c17963350a454b037de8a80722185
SHA1e1a86c3688d2aafe4d56a1d6de9b453e06858229
SHA25663ba118ff39ef7e2697e26b9bf3324bd36b4faa086ee0d17fb1c7cdb2b04073e
SHA51245f6ee987a9ddc0e2d0131aec2d141cb6695cf6809403d2a418e8fd84256408eedd1eeeaf9686aad1f55b46c74066e51414dbf8301f931b13ddacd26804e8698