Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 23:26
Static task
static1
Behavioral task
behavioral1
Sample
cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe
Resource
win10v2004-20240226-en
General
-
Target
cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe
-
Size
73KB
-
MD5
7ab1dd78de8c6989418cb7d016c0f714
-
SHA1
18e9604088617fe128b377524d9d70ddf7861eae
-
SHA256
cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b
-
SHA512
9d2cb5ec9b44fbbda49a90ef9a6b6c9865ebbe9ddbc36848f579d49571a6502330196d4aae1c0b1059f171306aa4ba04f8813ab22c4619c5759a04a0934b4114
-
SSDEEP
1536:hbt6TWFYUK5QPqfhVWbdsmA+RjPFLC+e5hA0ZGUGf2g:h5KRUNPqfcxA+HFshAOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2360 [email protected] -
Loads dropped DLL 2 IoCs
pid Process 2348 cmd.exe 2348 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2348 2488 cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe 30 PID 2488 wrote to memory of 2348 2488 cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe 30 PID 2488 wrote to memory of 2348 2488 cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe 30 PID 2488 wrote to memory of 2348 2488 cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe 30 PID 2348 wrote to memory of 2360 2348 cmd.exe 31 PID 2348 wrote to memory of 2360 2348 cmd.exe 31 PID 2348 wrote to memory of 2360 2348 cmd.exe 31 PID 2348 wrote to memory of 2360 2348 cmd.exe 31 PID 2360 wrote to memory of 2472 2360 [email protected] 32 PID 2360 wrote to memory of 2472 2360 [email protected] 32 PID 2360 wrote to memory of 2472 2360 [email protected] 32 PID 2360 wrote to memory of 2472 2360 [email protected] 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe"C:\Users\Admin\AppData\Local\Temp\cc728fff77b36c89b2e410414a908f679b226defd1ff03ca9ceaa5fbf0b7437b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c [email protected]2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2360
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:2472
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD57ce5fe1fb9255b2eab91272b334a331f
SHA1ec8b356ae3ce1e6795249a230042f386042da7d8
SHA25617617a64289ae8c37e959d3532fe7455c99276415d9659d35c2d464468fadf72
SHA512dcdd68021ff75147679292356bc65b0f5f5f0f9a725bfb2d91a15df39a58b60f521267b14d44714e94718c62bbe3b21018ebbe30a3ec933103efd5f51e0290c8