Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
bf7be684edd143fb2b70dcd0ffe11a58.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
bf7be684edd143fb2b70dcd0ffe11a58.exe
Resource
win10v2004-20231215-en
General
-
Target
bf7be684edd143fb2b70dcd0ffe11a58.exe
-
Size
744KB
-
MD5
bf7be684edd143fb2b70dcd0ffe11a58
-
SHA1
3f3911a0a59a27077e4c6d27bf12758d91cce6e0
-
SHA256
cab83facd18dcfd2e8e50368c9608555c592ab31ce82174018a9f53727d4d117
-
SHA512
b384e42fb89a06588f593df38272ff1841bfad582b45dfcc6f4b605b23b8c4b66fbb8b11a99c1d10eb016efa3e5c7c27dce32cc35ba2f7e4766648ee2632d97c
-
SSDEEP
12288:uaHc64b888888888888W888888888889jscV7TdjL47zdU5imqsX3sv33rD+zG/4:F86IIW7uvmQBsHUezG/aYFkJR30F6rpR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2792 bf7be684edd143fb2b70dcd0ffe11a58.tmp -
Loads dropped DLL 1 IoCs
pid Process 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 3 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2792 bf7be684edd143fb2b70dcd0ffe11a58.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2968 wrote to memory of 2792 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe 28 PID 2968 wrote to memory of 2792 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe 28 PID 2968 wrote to memory of 2792 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe 28 PID 2968 wrote to memory of 2792 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe 28 PID 2968 wrote to memory of 2792 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe 28 PID 2968 wrote to memory of 2792 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe 28 PID 2968 wrote to memory of 2792 2968 bf7be684edd143fb2b70dcd0ffe11a58.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf7be684edd143fb2b70dcd0ffe11a58.exe"C:\Users\Admin\AppData\Local\Temp\bf7be684edd143fb2b70dcd0ffe11a58.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\is-D5TKF.tmp\bf7be684edd143fb2b70dcd0ffe11a58.tmp"C:\Users\Admin\AppData\Local\Temp\is-D5TKF.tmp\bf7be684edd143fb2b70dcd0ffe11a58.tmp" /SL5="$400BE,371795,121344,C:\Users\Admin\AppData\Local\Temp\bf7be684edd143fb2b70dcd0ffe11a58.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2792
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb