Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/03/2024, 01:28
Static task
static1
Behavioral task
behavioral1
Sample
d792ea249e92b5383084ca524944579b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d792ea249e92b5383084ca524944579b.exe
Resource
win10v2004-20240226-en
General
-
Target
d792ea249e92b5383084ca524944579b.exe
-
Size
3.0MB
-
MD5
d792ea249e92b5383084ca524944579b
-
SHA1
372f264c81bf414da0e240031d3471e522df9c9d
-
SHA256
e176289ac2359e1303d1f6fdfbe0b96f979c82c8f34658852795e5cd90fb35ff
-
SHA512
1c60955de168debeff61827e5d7dde3328b123d4b31d28086302507c640fe22f6f6287c7ea787a0e731ae64edfcc7a626600302dd1e6841f80861cdb3755c508
-
SSDEEP
49152:BB+V1aScVdZUErhn3v2ycqRQUFYqOsDVjbp5P8yS27GcDopVQZtksfjSJocrupMp:f+V1a/VdZUErhn/2HqRQUWqOWjbp18Zv
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2020 setup.exe -
Loads dropped DLL 6 IoCs
pid Process 1936 d792ea249e92b5383084ca524944579b.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe -
Suspicious use of SetWindowsHookEx 40 IoCs
pid Process 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe 2020 setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1936 wrote to memory of 2020 1936 d792ea249e92b5383084ca524944579b.exe 28 PID 1936 wrote to memory of 2020 1936 d792ea249e92b5383084ca524944579b.exe 28 PID 1936 wrote to memory of 2020 1936 d792ea249e92b5383084ca524944579b.exe 28 PID 1936 wrote to memory of 2020 1936 d792ea249e92b5383084ca524944579b.exe 28 PID 1936 wrote to memory of 2020 1936 d792ea249e92b5383084ca524944579b.exe 28 PID 1936 wrote to memory of 2020 1936 d792ea249e92b5383084ca524944579b.exe 28 PID 1936 wrote to memory of 2020 1936 d792ea249e92b5383084ca524944579b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d792ea249e92b5383084ca524944579b.exe"C:\Users\Admin\AppData\Local\Temp\d792ea249e92b5383084ca524944579b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\~esetup\setup.exeC:\Users\Admin\AppData\Local\Temp\~esetup\setup.exe setup.dat2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2020
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5199e87ea6b03e907316560a58f7b51af
SHA18515b7d54e11ba32c52240044164b60b2f112341
SHA2560a0aee69b025f1206af1193b13e0476b49506b7d77ef2ed824ca169cfa749970
SHA5121221b91cad64a7739d2aa676924b87f68aceb66faa0edadd2f7e4fdf51054cae56bd2b846ebf69602fbe180ff0efe0218eb1a342d08ba175105d7b5fd4e4b277
-
Filesize
3.4MB
MD5f2d7c5f6e53a6e5d2c7d049ade58f615
SHA1a5fa4d2b9ef5119f7c3e0eb23b8c91f222295414
SHA2569a7e46cff89dd449d69caad8cfcb4544c271c788c515ec22e3aa576f478547c8
SHA512c0a25324c54d17de6343e578a4b20fe1b3ca5c242b6a0efd4dcb8b713c3383a243d4c8789dcf237a4c401bdb87c7ff4e72521db66778fc55d3cb5ec46f98ebda
-
Filesize
30KB
MD57de8a9ce8297ab6194783f768d238f7c
SHA1e5277e152d1aafbe7593b1cff1cab92ff812054f
SHA2569599cb4ce9dd8c2260b88f11a47c1e6f44116a14ef57137d63ba551b714c33dc
SHA51233a933ad6ace71a9539a286df0972fe9047475d7a560e9529d15a407eefc9333c762cf065abc9cb1f981af5511aef1f0127844fe6be0b9eaeadf46fe7fde21e3
-
Filesize
48KB
MD537a58e1c5ce48e401ee8dd1d1da54814
SHA1a87d00d78838c2d968b72330ee6f21f69b2caae5
SHA2561c426928fb90bedb31fcffa0f3fbe7bdbca4259f93f5abdefed6a9a089f2982c
SHA512e85052fc305040bdcaf47262e0ce6eef0848b319baac72a076dc94e7d20ea7ad8fbdd7d5381606a3154ab84fe81429bb339123ac1cd94551b1dc9cecfb7a08bf