Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/05/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe
Resource
win10v2004-20240419-en
General
-
Target
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe
-
Size
5.4MB
-
MD5
773ccd588fe6945616e45c19bf13490f
-
SHA1
c81058b04f40e87cf21469b567f53bcb8b290de0
-
SHA256
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720
-
SHA512
07909a12833d21c7a2a1173cd8201a551fccbfc6347131dea62b5d4610528f4e319d74284959755fd203d87433a3d6ba881319dee6e477413ef3195f795d8a52
-
SSDEEP
98304:emhd1UryeZqKsSzbyXDZPheE0V7wQqZUha5jtSyZIUh:elEKtkUE02QbaZtliU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1664 638.tmp -
Executes dropped EXE 1 IoCs
pid Process 1664 638.tmp -
Loads dropped DLL 2 IoCs
pid Process 2344 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 2344 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1664 2344 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 28 PID 2344 wrote to memory of 1664 2344 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 28 PID 2344 wrote to memory of 1664 2344 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 28 PID 2344 wrote to memory of 1664 2344 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe"C:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\638.tmp"C:\Users\Admin\AppData\Local\Temp\638.tmp" --splashC:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe F286A76919885A954A6AFBBB167C0AE4088BA8C34DD63FD468C3E724260C20E9BE35446065E16208B8862BFA058F36AA2844D0C50FB18971E87856A8235979252⤵
- Deletes itself
- Executes dropped EXE
PID:1664
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD5fa38c9209a6bd9f91533b556f95840b7
SHA1e3633e2c54c2f20ef601791752c4f5e254a9f15a
SHA2563c3de1f126aa3a158ba7364f2575a10a84c95931a7666009f6f2df7caf25242a
SHA51211f3efce1c7c21b4f74de081c8c76ad740a84ed3139e0ea838396e25307100f7408d7acf62acbe5ebb62a2fbc7cfe08e884fbbc1fa7b84145679e1d2f247c518