Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
3s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
bee5f2fad8536de09059278ee803b902.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bee5f2fad8536de09059278ee803b902.exe
Resource
win10v2004-20231215-en
General
-
Target
bee5f2fad8536de09059278ee803b902.exe
-
Size
9.4MB
-
MD5
bee5f2fad8536de09059278ee803b902
-
SHA1
869dcf08ef1f5d9fe23ef56986eec4c3d5041b65
-
SHA256
7c25dac4fd97ac041aee989706ee614a2bf91f45f4ea4239898ed5d60d4cc52b
-
SHA512
fd322f6b5016f316f74d0b5d6cfa8e2f3328852cf0818fd58864b57e757240bec6047a38a09b3f1d3e483227d11612eb14e2ab7b63b3bdf5e1f1c64f6b101964
-
SSDEEP
49152:EQFRHrmQG+wrmQG+brmQG+CQrmQG+wrxQG+CQrmQG+wrHIQG+wrJmQG+brmQG+CI:EcKOvpxZpxgYvpx62vpxdEvpx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2604 wtpjex.exe -
Loads dropped DLL 2 IoCs
pid Process 3032 bee5f2fad8536de09059278ee803b902.exe 3032 bee5f2fad8536de09059278ee803b902.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2604 3032 bee5f2fad8536de09059278ee803b902.exe 28 PID 3032 wrote to memory of 2604 3032 bee5f2fad8536de09059278ee803b902.exe 28 PID 3032 wrote to memory of 2604 3032 bee5f2fad8536de09059278ee803b902.exe 28 PID 3032 wrote to memory of 2604 3032 bee5f2fad8536de09059278ee803b902.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bee5f2fad8536de09059278ee803b902.exe"C:\Users\Admin\AppData\Local\Temp\bee5f2fad8536de09059278ee803b902.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\wtpjex.exeC:\Users\Admin\AppData\Local\Temp\wtpjex.exe -run C:\Users\Admin\AppData\Local\Temp\bee5f2fad8536de09059278ee803b902.exe2⤵
- Executes dropped EXE
PID:2604
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD569f660f33e51746ea75442d4d655c4c1
SHA1c01780d533e8025d46da73886692850195326c44
SHA256fc94138c0874588c9a93ceace42326b52de0ae7a483e94bdd5f23ea13f006343
SHA5126ad1e7ff0b8ec1531934105d11f01adab50ed5cbc99f2ff0a4546df85fcb0252267ff36789add8403ced6ede0391aaf52dffec34512f8479869eeb76543e3a40
-
Filesize
6.5MB
MD5478ced5467009c48232ea9b0ebf581d2
SHA1dbc1a0f6221c7b0675393131748ececbb307499e
SHA256306e84e05c02e99f1317deea3ccf012243fdff378ca133fdf9dbea5a08d67357
SHA5122d0ca8f76b7aba937a7e1064aceee288d33d20c75335b16c22de48c57005befcd8ee800a4c0c140383f37e1bc0d198edcb94a945c78c273fdac8632f8f40b247
-
Filesize
5.8MB
MD5829998370a81463554d542fc8b53d943
SHA199037e2d8140506b3285e97e9b2a997c83197603
SHA2563c0f228016abe7915d604d94b8c011ab357b59a815024c2cbfe688d319a92436
SHA512cb2a67835721071b890e4cb79b8a9fc6d54a060e9d03e50b2108068f48948fba3532be0caa1e598aa0b823ccc15107713014f32116025c669e5cde88734ad248
-
Filesize
192KB
MD5e37c01f65f5a809f52f49309d8252e6f
SHA11e981bbd031ca3729576b4bfe102fc5404bbcb0e
SHA25695238a4a86669426a0f16e69634d9401ac62562604bcb7f7c385f58f4573e3d0
SHA5128bf746d5b192a2f8de487d1f87b31609292996fe62ccc8f97df8c4db8d59a1a4090b8f3de15fc4f7a0059662d026ec91f0f8eb6f06a500b727de8c21643aaa1a
-
Filesize
7.3MB
MD5759ab83affd4a198e5ded821f49cab8b
SHA1f2ec4e0f1c1d6883ab9a0137f9ddc4f171b61985
SHA256ac7a16af48f5696a48958be13e8b8c0b1443dc8699746d42c1a7c397d690e182
SHA512e43c8a1ec8c110cef1ffacdc54f9cc3fdc561f21777d6f24a36b2197c69d92b3329d1f1eca0fa80ba0408bb77bcf3778be8d1f348ee23a428e099e7ba5466ebc