Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe
Resource
win10v2004-20240419-en
General
-
Target
035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe
-
Size
736KB
-
MD5
d3b83feb3e0158463cfe3d2355edffbc
-
SHA1
f79c057c1c214b4d7d1a737f7439c83bb01dc314
-
SHA256
035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56
-
SHA512
5174b29ab6758401ee873a640e4cec8592a055d45ae2c460caaa073f69965a77c24f4c81416510562fcf4f8b4aaaaaa979ffe677ca4c60a36aff4a27695dc058
-
SSDEEP
12288:IWBm+95nHfF2mgewFx5AZrfpI3vTckaIw+zZ1kfgjdkAW10iwJZnEIf6qCWpJKtR:IWBz95ndbgfx5QrBIQkHw9gjTW10iwJS
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2960 483.tmp -
Executes dropped EXE 1 IoCs
pid Process 2960 483.tmp -
Loads dropped DLL 1 IoCs
pid Process 2392 035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2960 2392 035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe 28 PID 2392 wrote to memory of 2960 2392 035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe 28 PID 2392 wrote to memory of 2960 2392 035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe 28 PID 2392 wrote to memory of 2960 2392 035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe"C:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp" --pingC:\Users\Admin\AppData\Local\Temp\035bd7a9bbf8fe410389c71990ebac3f07cd8cf69d8dbab991f477746902cb56.exe 98F089D89C91D6C41D83343E0E5A16101EFCB523338550F2A4194F477872E60F01C0C3B7A9BCF89BD4EBE3D74208C3D183B49D0838EC12E915B6ADF30E1DE9422⤵
- Deletes itself
- Executes dropped EXE
PID:2960
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736KB
MD5e3a3f70582709f27095eab806a91ffd6
SHA14df0103d0c69588aba952fab525622dcda7a8c3b
SHA2567cf066aed89e34815906175faf97f4a29239b8bde9d0aaaa23e4add5bdaf1db3
SHA5121e1ed63a84a24d406503953917bb5e8f864da263da5a2fac7512e67d5766fef69273c7f7e9c2ecf1dfa84e781a2434e0695c40cf5b93a58db5ad602344604fb7