Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 14:24
Static task
static1
Behavioral task
behavioral1
Sample
Toolbox OptimizerV1.0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Toolbox OptimizerV1.0.exe
Resource
win10v2004-20240226-en
General
-
Target
Toolbox OptimizerV1.0.exe
-
Size
455KB
-
MD5
0569b38220c2d30697ffbc398308f213
-
SHA1
d01b93f9b2c6c6f8269e47134ee2a8639cdb29af
-
SHA256
cdb4690f2f00fef918fc2f175c19045f0fb346a499e59f0b8ec2a6f64b03f52e
-
SHA512
380ad86a1f83d2f9cd2461f666fc38245c8a0dea1a6bcdf5ad5b161fd72d092826cb5fb33bb278cec09866e9a8dfa95b054fa1d35719e52665e85cfbdfe9374f
-
SSDEEP
3072:Q7DhdC6kzWypvaQ0FxyNTBf87pzseuW8Rz7m2klts+CDiVsgw7b6:QBlkZvaF4NTBE7LUKwzgw7b6
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3012 3048 Toolbox OptimizerV1.0.exe 29 PID 3048 wrote to memory of 3012 3048 Toolbox OptimizerV1.0.exe 29 PID 3048 wrote to memory of 3012 3048 Toolbox OptimizerV1.0.exe 29 PID 3048 wrote to memory of 3012 3048 Toolbox OptimizerV1.0.exe 29 PID 3012 wrote to memory of 1296 3012 cmd.exe 30 PID 3012 wrote to memory of 1296 3012 cmd.exe 30 PID 3012 wrote to memory of 1296 3012 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\7E06.tmp\7E07.tmp\7E08.bat "C:\Users\Admin\AppData\Local\Temp\Toolbox OptimizerV1.0.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\mode.commode con:cols=128 lines=403⤵PID:1296
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD53512b263fbfaa854e3dffc248d511dd4
SHA1db752939ffb2659bd32b9c4b91c2173a6a505082
SHA2567dc4222c41085904ae65a81d758911fd0b1ef3f0578368fc5d17c3e0240d2450
SHA5128f54d744bf9e1368352049f3ec9aa5422494c66d7ea1e9893b3d0daecc773810148076dcfe1160b2f36ee93aa5b18ff013992b6e3abd1c8517429ff76b54cba2