Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 22:37
Static task
static1
Behavioral task
behavioral1
Sample
53a36cbb00550f3f97a89be92cdce226.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
53a36cbb00550f3f97a89be92cdce226.exe
Resource
win10v2004-20240226-en
General
-
Target
53a36cbb00550f3f97a89be92cdce226.exe
-
Size
932KB
-
MD5
53a36cbb00550f3f97a89be92cdce226
-
SHA1
109ba71acaa6d64c513681256c210eda44688ce9
-
SHA256
e422b55b127daa388fcda1d73499148aad38409fe919b0b3efa3ea34fbdb67b5
-
SHA512
be19b62a0d54e30f334dd846863567ba182be5dd64c1da0fbfea6965ee60855d815aeaf3f61a432d5162500b4e14201a2ab28963a407832f17c3df091eacedb0
-
SSDEEP
24576:Tab0KJc0Dsaz2DYh8HroUELZmN17UZmlSJrE:Tab0KlIFYh8H9wZmXgZmlSJrE
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2188 15B2.tmp -
Executes dropped EXE 1 IoCs
pid Process 2188 15B2.tmp -
Loads dropped DLL 1 IoCs
pid Process 1984 53a36cbb00550f3f97a89be92cdce226.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2188 1984 53a36cbb00550f3f97a89be92cdce226.exe 29 PID 1984 wrote to memory of 2188 1984 53a36cbb00550f3f97a89be92cdce226.exe 29 PID 1984 wrote to memory of 2188 1984 53a36cbb00550f3f97a89be92cdce226.exe 29 PID 1984 wrote to memory of 2188 1984 53a36cbb00550f3f97a89be92cdce226.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\53a36cbb00550f3f97a89be92cdce226.exe"C:\Users\Admin\AppData\Local\Temp\53a36cbb00550f3f97a89be92cdce226.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\15B2.tmp"C:\Users\Admin\AppData\Local\Temp\15B2.tmp"2⤵
- Deletes itself
- Executes dropped EXE
PID:2188
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
932KB
MD59561c08bb450f7b4276c92f5fe4278da
SHA14a463057785ca30146619f7fb251655624e1f121
SHA25683092261bf8a976dedbe5d09acbebe356563ca0509b1d3a8c87d7418a593c46d
SHA512255da1543ae2d2020bdd7b43a48d7ad8d591b094ea173557648df0175fc360b678252e1c05f1ffd876aa54be8ef20d21f7e8a6c5971622b3760725f67cbcc87d