Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/04/2024, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe
Resource
win10v2004-20240226-en
General
-
Target
c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe
-
Size
2.4MB
-
MD5
a38348fce06996c2de1f9a95f03f9839
-
SHA1
e91f561bccf51074176e9fb2688df0c678ab7e96
-
SHA256
c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c
-
SHA512
0d27a4a8276073da104fdc8d124f88b93499b8064a01db5d5e78104b6c6a3c1d0d269b87ba9b1a213a7e37c15172c576c2d05f41bc025425319cc3e6f1b0960f
-
SSDEEP
49152:aiCrJIy71fOTo+08XgT+xcpj2r+MRDlJpugGn5hHlZoYN:aiTy7129vdc2CMRDlJpuD5hFZbN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2904 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.tmp -
Loads dropped DLL 1 IoCs
pid Process 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2904 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2904 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe 28 PID 2908 wrote to memory of 2904 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe 28 PID 2908 wrote to memory of 2904 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe 28 PID 2908 wrote to memory of 2904 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe 28 PID 2908 wrote to memory of 2904 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe 28 PID 2908 wrote to memory of 2904 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe 28 PID 2908 wrote to memory of 2904 2908 c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe"C:\Users\Admin\AppData\Local\Temp\c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\is-5H2M7.tmp\c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.tmp"C:\Users\Admin\AppData\Local\Temp\is-5H2M7.tmp\c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.tmp" /SL5="$C0152,1649240,851968,C:\Users\Admin\AppData\Local\Temp\c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2904
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\is-5H2M7.tmp\c682e0ab21397b7c0f6a475c1832e14f825ce20c5574a570165d873ca87fae7c.tmp
Filesize3.1MB
MD553ff24287f2a25f324d9c68648c01fac
SHA1274b830a570f6a9a8beea5920b914021f4c45a7c
SHA2567bad1f5284fd72c637139ecdd050add7cfc0c43a6492bc7395df68fa0fc28494
SHA512b1fb99f8491bf6850fe307fcdd478db4e8046ee25502e0636637ffdab4cdbc83f6bd4aab30c95465e01f889c44c1d603541aae01f0aeadf836a9d8f3132f6523