Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 01:55
Static task
static1
Behavioral task
behavioral1
Sample
ccd12e6eaa3d7113c958e82a290b5e38.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ccd12e6eaa3d7113c958e82a290b5e38.exe
Resource
win10v2004-20231215-en
General
-
Target
ccd12e6eaa3d7113c958e82a290b5e38.exe
-
Size
776KB
-
MD5
ccd12e6eaa3d7113c958e82a290b5e38
-
SHA1
0b4ec34fb5eb1aeb9048de77a55ac2acd60fa0b5
-
SHA256
47f0202cd563d58af7452adcd7b699333a9fbb2522f436c842d88be1c9b5c7df
-
SHA512
05c812692d04daa6e0acdd2a020cd0544514985c1228d1c4aa5e33b6b0eea93174132d666fa36a1907373711a5bf7851a0c8616fa80cb7843d5d2951cabc7f8e
-
SSDEEP
24576:5najkaZVHWaRJAVCafPvzkS3rJQBtUkBgJ:5ag8WaRJ1mvPinXBgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3032 ccd12e6eaa3d7113c958e82a290b5e38.tmp -
Loads dropped DLL 5 IoCs
pid Process 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 3032 ccd12e6eaa3d7113c958e82a290b5e38.tmp 3032 ccd12e6eaa3d7113c958e82a290b5e38.tmp 3032 ccd12e6eaa3d7113c958e82a290b5e38.tmp 3032 ccd12e6eaa3d7113c958e82a290b5e38.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 ccd12e6eaa3d7113c958e82a290b5e38.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1148 wrote to memory of 3032 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 28 PID 1148 wrote to memory of 3032 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 28 PID 1148 wrote to memory of 3032 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 28 PID 1148 wrote to memory of 3032 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 28 PID 1148 wrote to memory of 3032 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 28 PID 1148 wrote to memory of 3032 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 28 PID 1148 wrote to memory of 3032 1148 ccd12e6eaa3d7113c958e82a290b5e38.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccd12e6eaa3d7113c958e82a290b5e38.exe"C:\Users\Admin\AppData\Local\Temp\ccd12e6eaa3d7113c958e82a290b5e38.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\is-DVKFV.tmp\ccd12e6eaa3d7113c958e82a290b5e38.tmp"C:\Users\Admin\AppData\Local\Temp\is-DVKFV.tmp\ccd12e6eaa3d7113c958e82a290b5e38.tmp" /SL5="$400BE,433948,54272,C:\Users\Admin\AppData\Local\Temp\ccd12e6eaa3d7113c958e82a290b5e38.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:3032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
214KB
MD576a8665b79ee92ffbcfe4c832de22637
SHA1f3fedee7879799346c751491a0a7ca2113777ff8
SHA25622dd4cac448128c57027131211dea47d6889be028322594afffc35276a1bd1ef
SHA5127f13cb0517d84efd478a049769519d2098d1833dc4ea0177e18ce3a3d3f588054797feb8b64c6f860dcd39c58f87923ff9baa21018f11b2bb175fcd935bd9775
-
Filesize
211B
MD530412e8752b344d00a68dcda8acb909b
SHA128e7f1817347adddac396c5ef667b39769dbc4fe
SHA2560604864fbbf6d13e947a09abd34256e128d2d4437929ddb473fd694deddda76d
SHA5121983ba48f0faa1bfaa64a1889a6ca4df65cad18c80c8202ce4e9299bd93f056aca81e0f9fd8ac67627bb8193974c05f91839d810a9ef41c788ce8b8623971306
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
49KB
MD502ecc74f7f91e9ffd84de708683236a6
SHA13532de0b77df8b0fc89e9c7eddec3fa71f98f5a2
SHA25630ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e
SHA512a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df