Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
4c0383cfa6da836311bbfc00632135c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4c0383cfa6da836311bbfc00632135c3.exe
Resource
win10v2004-20240226-en
General
-
Target
4c0383cfa6da836311bbfc00632135c3.exe
-
Size
892KB
-
MD5
4c0383cfa6da836311bbfc00632135c3
-
SHA1
fa92c6ba2c294466cfe3572aef88b2f2e00d9ef7
-
SHA256
de76847b3cfc02c0ab53e04e2ec142b512e60d8129715a6eefa61fbaf8ce8db9
-
SHA512
157f81ce9ca9c0df14a434a8128fb778d91613b3cbaa035bec570a54acfdf8f8e7b6a40b61a4158cb89651df879a4a31d0dded9a52174f431abb2c30b0ce0cdd
-
SSDEEP
24576:YoSAVypIfpgb067GUmaQqy9qMsiQrGR0So:YoSAV8Qa/7GU3Qh8JrGRw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2384 INS8546.tmp -
Loads dropped DLL 3 IoCs
pid Process 1476 4c0383cfa6da836311bbfc00632135c3.exe 2384 INS8546.tmp 2384 INS8546.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2384 INS8546.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2384 1476 4c0383cfa6da836311bbfc00632135c3.exe 28 PID 1476 wrote to memory of 2384 1476 4c0383cfa6da836311bbfc00632135c3.exe 28 PID 1476 wrote to memory of 2384 1476 4c0383cfa6da836311bbfc00632135c3.exe 28 PID 1476 wrote to memory of 2384 1476 4c0383cfa6da836311bbfc00632135c3.exe 28 PID 1476 wrote to memory of 2384 1476 4c0383cfa6da836311bbfc00632135c3.exe 28 PID 1476 wrote to memory of 2384 1476 4c0383cfa6da836311bbfc00632135c3.exe 28 PID 1476 wrote to memory of 2384 1476 4c0383cfa6da836311bbfc00632135c3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0383cfa6da836311bbfc00632135c3.exe"C:\Users\Admin\AppData\Local\Temp\4c0383cfa6da836311bbfc00632135c3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\INS8546.tmpC:\Users\Admin\AppData\Local\Temp\INS8546.tmp /SL3 $6014E C:\Users\Admin\AppData\Local\Temp\4c0383cfa6da836311bbfc00632135c3.exe 905445 908805 614402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD599fa571a302c7e8ed49d149c1c700623
SHA155f36c6868d698cf9f4b84296b51737b34d014d0
SHA256d2e9c5966937beadba64d89d3ce31212c61a85118d9662adb98fdeac1ad6eb44
SHA512f14a45f0cf8b338efa4371ca88767189cce8ef919aa7c691ba7105a393acaf07b43721f2a74417075aa99acea875cc5de4c7a09fd38dad6f913b9a675c0ddec0
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3