Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
e215bf7dbaafd82c074e0808cedaef57.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e215bf7dbaafd82c074e0808cedaef57.exe
Resource
win10v2004-20240226-en
General
-
Target
e215bf7dbaafd82c074e0808cedaef57.exe
-
Size
200KB
-
MD5
e215bf7dbaafd82c074e0808cedaef57
-
SHA1
7b1f384fb969e33d335fbfaad825c50fa159728b
-
SHA256
2131bf0465c1ef826f41a864e2ea183350df3169fce5180bc65cfdb22b1ced67
-
SHA512
9f4d7b281630f0f07a32cb76c49e8fffcdd0d9c200b6dda9792ac35900e60e400401c983d010798268978df56798e5a6876bb485731db16c38f9b055f77dd703
-
SSDEEP
3072:EHHyIXRECLgDsdCtykxdaA3dYCvhOtJYVQcA5fM0LVO6u9sU2gk8TKeWZdPuIG1/:Ehmkg1dagdYhmLpqOqt0TeA2sg6/
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1968 e215bf7dbaafd82c074e0808cedaef57.exe 1968 e215bf7dbaafd82c074e0808cedaef57.exe 1968 e215bf7dbaafd82c074e0808cedaef57.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2600 1968 e215bf7dbaafd82c074e0808cedaef57.exe 28 PID 1968 wrote to memory of 2600 1968 e215bf7dbaafd82c074e0808cedaef57.exe 28 PID 1968 wrote to memory of 2600 1968 e215bf7dbaafd82c074e0808cedaef57.exe 28 PID 1968 wrote to memory of 2600 1968 e215bf7dbaafd82c074e0808cedaef57.exe 28 PID 1968 wrote to memory of 2936 1968 e215bf7dbaafd82c074e0808cedaef57.exe 31 PID 1968 wrote to memory of 2936 1968 e215bf7dbaafd82c074e0808cedaef57.exe 31 PID 1968 wrote to memory of 2936 1968 e215bf7dbaafd82c074e0808cedaef57.exe 31 PID 1968 wrote to memory of 2936 1968 e215bf7dbaafd82c074e0808cedaef57.exe 31 PID 1968 wrote to memory of 1612 1968 e215bf7dbaafd82c074e0808cedaef57.exe 32 PID 1968 wrote to memory of 1612 1968 e215bf7dbaafd82c074e0808cedaef57.exe 32 PID 1968 wrote to memory of 1612 1968 e215bf7dbaafd82c074e0808cedaef57.exe 32 PID 1968 wrote to memory of 1612 1968 e215bf7dbaafd82c074e0808cedaef57.exe 32 PID 1968 wrote to memory of 2736 1968 e215bf7dbaafd82c074e0808cedaef57.exe 34 PID 1968 wrote to memory of 2736 1968 e215bf7dbaafd82c074e0808cedaef57.exe 34 PID 1968 wrote to memory of 2736 1968 e215bf7dbaafd82c074e0808cedaef57.exe 34 PID 1968 wrote to memory of 2736 1968 e215bf7dbaafd82c074e0808cedaef57.exe 34 PID 1968 wrote to memory of 2064 1968 e215bf7dbaafd82c074e0808cedaef57.exe 35 PID 1968 wrote to memory of 2064 1968 e215bf7dbaafd82c074e0808cedaef57.exe 35 PID 1968 wrote to memory of 2064 1968 e215bf7dbaafd82c074e0808cedaef57.exe 35 PID 1968 wrote to memory of 2064 1968 e215bf7dbaafd82c074e0808cedaef57.exe 35 PID 1968 wrote to memory of 2020 1968 e215bf7dbaafd82c074e0808cedaef57.exe 36 PID 1968 wrote to memory of 2020 1968 e215bf7dbaafd82c074e0808cedaef57.exe 36 PID 1968 wrote to memory of 2020 1968 e215bf7dbaafd82c074e0808cedaef57.exe 36 PID 1968 wrote to memory of 2020 1968 e215bf7dbaafd82c074e0808cedaef57.exe 36 PID 1968 wrote to memory of 856 1968 e215bf7dbaafd82c074e0808cedaef57.exe 37 PID 1968 wrote to memory of 856 1968 e215bf7dbaafd82c074e0808cedaef57.exe 37 PID 1968 wrote to memory of 856 1968 e215bf7dbaafd82c074e0808cedaef57.exe 37 PID 1968 wrote to memory of 856 1968 e215bf7dbaafd82c074e0808cedaef57.exe 37 PID 1968 wrote to memory of 1672 1968 e215bf7dbaafd82c074e0808cedaef57.exe 38 PID 1968 wrote to memory of 1672 1968 e215bf7dbaafd82c074e0808cedaef57.exe 38 PID 1968 wrote to memory of 1672 1968 e215bf7dbaafd82c074e0808cedaef57.exe 38 PID 1968 wrote to memory of 1672 1968 e215bf7dbaafd82c074e0808cedaef57.exe 38 PID 1968 wrote to memory of 2676 1968 e215bf7dbaafd82c074e0808cedaef57.exe 39 PID 1968 wrote to memory of 2676 1968 e215bf7dbaafd82c074e0808cedaef57.exe 39 PID 1968 wrote to memory of 2676 1968 e215bf7dbaafd82c074e0808cedaef57.exe 39 PID 1968 wrote to memory of 2676 1968 e215bf7dbaafd82c074e0808cedaef57.exe 39 PID 1968 wrote to memory of 2280 1968 e215bf7dbaafd82c074e0808cedaef57.exe 41 PID 1968 wrote to memory of 2280 1968 e215bf7dbaafd82c074e0808cedaef57.exe 41 PID 1968 wrote to memory of 2280 1968 e215bf7dbaafd82c074e0808cedaef57.exe 41 PID 1968 wrote to memory of 2280 1968 e215bf7dbaafd82c074e0808cedaef57.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\e215bf7dbaafd82c074e0808cedaef57.exe"C:\Users\Admin\AppData\Local\Temp\e215bf7dbaafd82c074e0808cedaef57.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinE37D.bat"2⤵PID:2600
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin5B6D.vbs"2⤵PID:2936
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin2C36.vbs"2⤵PID:1612
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin63F7.vbs"2⤵PID:2736
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin5B6D.vbs"2⤵PID:2064
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin4F4B.vbs"2⤵PID:2020
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin546B.vbs"2⤵PID:856
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\system32\wscript.exe" /nologo "C:\Users\Admin\AppData\Local\Temp\_tin63F7.vbs"2⤵PID:1672
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin1749.bat"2⤵PID:2676
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tinCB36.bat"2⤵PID:2280
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58150f458ed6fb9b1db4e5cfa57a1a281
SHA16e5726854d28687b560d7fdcb5c782c425c7dfb9
SHA2564c13d452dd5d49671bd93ca32f2b4f85c78e39b6ab0ad1f38d98ed267f8fd896
SHA5124cc6a112673aef8bb8bb8a385c26791b805d43bb707b509880e894f1c83bab4e16f13de187036c5f660c3bec1d286258396b7bde65c5d7945c5019665196818c
-
Filesize
15KB
MD5011c08dab1dd0bad6960ddabba460c50
SHA10864a756ec8bf0e51cce91cff93c7c2c404208da
SHA2562a095e2ae908ac5e5e3268b5f5fd12752e92c6d46b847d324c9cae67174a1c10
SHA512db7ded3195156aa835cc32f2e8676e2c8f7c2449a56fd823c3f29ec5f200deb2e4389dee9ec3c96d3c27aa01d80d5cff8d8ed39f7592b955ba484ae90aacc165
-
Filesize
4KB
MD5c3926cef276c0940dadbc8142153cec9
SHA1f8b350d2b7158f5ab147938961439860d77b9cb4
SHA2560ec48e3c1886bc0169a4bc262f012e9b7914e3b440bb0ecc4d8123924abc9b93
SHA5125b9958095b8a7b39b3a2226a5242faec8d2d799d10e1e4ed6dbfb8aaebe51b7496cf4bb5ad588366a296671df3ba46a3f42860abc7f9501b4cc5efd55dd87904
-
Filesize
50B
MD5882a503feb9df891ed31a079f88ff08f
SHA147f6addab10dc38c27207f74c8cbd3fd9931a941
SHA25631042819b11c51593180a4e718ec4492c18a5bff2d16a84ce38a0db587f9eee8
SHA5129c3655eaf3a34c3f8a05c03c16929e17bb137358b5270084d525168409628dba0534007bd2f86d19233cc3dc5f29011fd89858327c5ec84fabaa3c1f33674c36
-
Filesize
1KB
MD5a90ebd920e0fb3e061e0ddc902d15172
SHA1952d0fb4a1fb6b04db5e0c467a0ffef1c944e29f
SHA256ea996d33053a8745151c75e1855a35e38bf51961c13c1e36edf90acff8429ed2
SHA512693723c6a84eaf6535df63cc87dab88b8517764c67391e56929f85807fd8eca0af6df0630656bca333cb38b1f7fc0e153c27b438969712b1381070495219fe50
-
Filesize
419B
MD5e6e62a8adcf4c349f876283ba0a0875b
SHA17cdd90e47897d065810c3a1ff88d2e81c31d69fb
SHA25657f1bb991447a33ac15dd6274932863e9734c8f272612a59a66b1d8d7668341a
SHA5128347789c4a54d7c461f53acaa775179f896856e2938f995929b18eda35151af0d697f6083f5d321846e182288a08b4b18519cc0927f065791b606f4e9508cf19
-
Filesize
819B
MD512ae60c8c91af5d9d8ed467c574cdf6f
SHA1a9c4995f72a6688b469ccf6a003088253466c60c
SHA256fbc82fe658adcea42fd59862531afbe31a0dda98f910368bc11db21bb3da3a0a
SHA51299dcd8dca70716ec589665ca6eddcb7c651f26ca3216e7ca037807a5805c7893e3d295f2400013f90b3df664d3ccdfbfb4f61aa994590a45547483ff19356394
-
Filesize
304B
MD59beae0dc2d364c9969ccfbdadeaec86c
SHA1e8320f98d17a9fa80d82b8b97efea43ecd9a6a60
SHA256c121d86af7a3a707defc4d9f534cf0d54f1924a275db2feed88e32767b6ca3c2
SHA5129c71cc031520cd9c5f9d4af9344a46f81074e93f770342a92a26a39687318d9ec42849c8aafa822bc16669c8967bf85525ac7d1b563183608667874bb694636f
-
Filesize
2KB
MD501a3e070dc10d6b28180252a06657c15
SHA14770452703b92f52273af515d41340654723bc90
SHA2569c48d285ff8e6c0d684c37627ee4779f6e2a11ec5ff2fad4a508b670981c726c
SHA512252591eb310561b88b13f036a83c9eae6f068dd23868ffb6f99df1a6e398bb012995d71d769ddd86ada7f285be155dc8048df1a1f28498e26572a27dc38ea849
-
Filesize
46B
MD5b593cf3db5f272b65c3afa729a21728d
SHA11a0b460b5760b84896b023d2eea2678766fca011
SHA2566f25c149ffe77e59de9d76ebf3009f71d98c6aa57628fc49067d8704c3ffbd2a
SHA512bbc39749ec4dc514e5fb6c36ea74e81be7910387eb8326bf4f5093be8f783d4b2f5c3d5f20f751186c763a1ed195ad2831442a516a62c7220dc3b3502a5a1d42
-
Filesize
44B
MD592104e1449637dce33276ce28005c9e2
SHA1fe4a1a1fb606e964d180c9d0a2009af3b4dc989f
SHA2563bfed3974fe70b84131521fd982b53e7606375edde23dafeb2f41b99b951cca7
SHA51218c13f3ec7c51dee7dddc9a0de1b42b4932dc303fc2b098e9294d7876cda6aa2b0c48270f032da28054e218edbc01428d4df08a690b6b48a72ae591c4fea9af7
-
Filesize
74KB
MD5730707ba34c5d81c2c165cedb4d07e0e
SHA16ff7cb793aaef8133123badf2a819df4c3305c7c
SHA2566052cd79fabac32b1a27d3cd42f6a12f67f28962737abef1c39d896d5bdb8108
SHA5129391b6f8a08ccdf0c2565f66e857ae9810deb81da579c86a9e932d8cbb94adce67b98ce9a8701bc76e9cebe0e11dc55a91ec554f5c620b9d657e6a35772965cc
-
Filesize
16KB
MD5a3e3a7c55dac05898f398f0ef4ef16fd
SHA12245eebc8ef1d3c1ae7f395ce168b0a93fb0f016
SHA25625e262cf0f72f8e8bcd0bc6f4cabcd8dcf397ac027cce46ce8ac19511afabffe
SHA512e7d8e21b6f40caccf519ba27895c09ae07ade7c82982265c249228ed0bd18179b6e25dedf2596e6be60db782d80cfeb014c43c5d25757c156d54fd5ae4193d90
-
Filesize
245KB
MD50ad3f6b76368a27813d3d941458bafc2
SHA1ce21514b78dd67d8d9562b3983abf8755a8c0a88
SHA2568fbd7e9bcd9f281aed0f5e8d06c821dd2b33fce0ddc17b864e0ceca6b90b31b2
SHA512c75210165ecf296ba4d04cbab2323118afbab9ddb420b8309cf744b3273485cb1e152027fe35354047c4c0bd0d83ec17a73c8eea8575bc0a4714c98cc5a478b0