Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
c8140a8941812d6f5ab0235bb0467036.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c8140a8941812d6f5ab0235bb0467036.exe
Resource
win10v2004-20240226-en
General
-
Target
c8140a8941812d6f5ab0235bb0467036.exe
-
Size
1.9MB
-
MD5
c8140a8941812d6f5ab0235bb0467036
-
SHA1
877d2ed7adb512848be94b74a4a22b6d19556447
-
SHA256
1a463693f9e2538a45b9edd43a2cfdd512f3e2a0e2d86eb295f3b477236dc2b6
-
SHA512
850b0986dd787fd889f3b39bfcf8a15448a4710bcf05a7f71b34b0add84ffac4f7cdd84e523bb79808071c9d68a7ff44049a1eb463e722e943c48c3e698227bc
-
SSDEEP
49152:Qoa1taC070dH/a08I7hJn2asD+My/0r30FJ+MSEHiH:Qoa1taC0cS08wrRsDM/b0a0
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2988 1239.tmp -
Executes dropped EXE 1 IoCs
pid Process 2988 1239.tmp -
Loads dropped DLL 1 IoCs
pid Process 2924 c8140a8941812d6f5ab0235bb0467036.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2988 2924 c8140a8941812d6f5ab0235bb0467036.exe 28 PID 2924 wrote to memory of 2988 2924 c8140a8941812d6f5ab0235bb0467036.exe 28 PID 2924 wrote to memory of 2988 2924 c8140a8941812d6f5ab0235bb0467036.exe 28 PID 2924 wrote to memory of 2988 2924 c8140a8941812d6f5ab0235bb0467036.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8140a8941812d6f5ab0235bb0467036.exe"C:\Users\Admin\AppData\Local\Temp\c8140a8941812d6f5ab0235bb0467036.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp" --splashC:\Users\Admin\AppData\Local\Temp\c8140a8941812d6f5ab0235bb0467036.exe 14895B5387F70D7CCE145D029EFE83DC824BC3C4B8AF8DBE7609318803EDA41BAC881C32A393188832507D587CAA31E621EFCB24A6E383688E08C44DBD3D02862⤵
- Deletes itself
- Executes dropped EXE
PID:2988
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD536ee66454ce6297e0ebd252d813a4c5e
SHA15f07ec33c7fbbe835584c7b53afc56173313bc6b
SHA25657a0e2f1db85227516455a053f0680f48ba258cc02509c0c86d7062b4d26c5bd
SHA5127273efc7a02ba0636cdf8d60a5aefca54017e3eb80f3ae8fea331e1083393d10b98ef8b03fb13ed64e0019bba6d841a82bc72d1af790f2a7ea0e4bb258962df3