Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02/05/2024, 03:12
Static task
static1
Behavioral task
behavioral1
Sample
c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe
Resource
win10v2004-20240426-en
General
-
Target
c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe
-
Size
2.4MB
-
MD5
8a7b8ad4b528f2eee93ca9b2fac2515d
-
SHA1
d9f0e15be8a8672b08f99a5ded01ad774ff7d24f
-
SHA256
c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b
-
SHA512
ac0c85423063df63f548a3db62a5bfd8b22d3350e0e58a2f2d17321326e8c3df3d1088ba19a4ce57b2544a7f8f00a0a09f2ae86a4eb0fecfbe908276c62aae0d
-
SSDEEP
49152:JMDRZ9IBVL+s0ezJGd80SHMsThF35Hj1Bzudu:JMDtIXLr06AdfEThF35Pzuk
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2696 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2448 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe -
Loads dropped DLL 1 IoCs
pid Process 2696 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2596 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2760 timeout.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3020 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 28 PID 2128 wrote to memory of 3020 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 28 PID 2128 wrote to memory of 3020 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 28 PID 2128 wrote to memory of 3020 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 28 PID 3020 wrote to memory of 2032 3020 cmd.exe 30 PID 3020 wrote to memory of 2032 3020 cmd.exe 30 PID 3020 wrote to memory of 2032 3020 cmd.exe 30 PID 3020 wrote to memory of 2032 3020 cmd.exe 30 PID 2128 wrote to memory of 2696 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 31 PID 2128 wrote to memory of 2696 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 31 PID 2128 wrote to memory of 2696 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 31 PID 2128 wrote to memory of 2696 2128 c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe 31 PID 2696 wrote to memory of 2680 2696 cmd.exe 33 PID 2696 wrote to memory of 2680 2696 cmd.exe 33 PID 2696 wrote to memory of 2680 2696 cmd.exe 33 PID 2696 wrote to memory of 2680 2696 cmd.exe 33 PID 3020 wrote to memory of 2596 3020 cmd.exe 34 PID 3020 wrote to memory of 2596 3020 cmd.exe 34 PID 3020 wrote to memory of 2596 3020 cmd.exe 34 PID 3020 wrote to memory of 2596 3020 cmd.exe 34 PID 2696 wrote to memory of 2448 2696 cmd.exe 35 PID 2696 wrote to memory of 2448 2696 cmd.exe 35 PID 2696 wrote to memory of 2448 2696 cmd.exe 35 PID 2696 wrote to memory of 2448 2696 cmd.exe 35 PID 2696 wrote to memory of 2760 2696 cmd.exe 36 PID 2696 wrote to memory of 2760 2696 cmd.exe 36 PID 2696 wrote to memory of 2760 2696 cmd.exe 36 PID 2696 wrote to memory of 2760 2696 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe"C:\Users\Admin\AppData\Local\Temp\c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zbe20245231258336.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\schtasks.exeSchtasks.Exe /delete /tn "Maintenance" /f3⤵PID:2032
-
-
C:\Windows\SysWOW64\schtasks.exeSchtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx20245231258336.xml"3⤵
- Creates scheduled task(s)
PID:2596
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zb20245231258336.bat" "2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:2680
-
-
C:\Users\Admin\AppData\Local\Temp\c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe"C:\Users\Admin\AppData\Local\Temp\c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe"3⤵
- Executes dropped EXE
PID:2448
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3 /nobreak3⤵
- Delays execution with timeout.exe
PID:2760
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
752B
MD5dca4dbc2af3439c0fb94729a2aabaf4f
SHA1abd930da4bdde39974d03e847eb7fb207b2dd171
SHA25691288bbb2b0427ee47c8b28995df56e4a3b34bdc6599f33d0b45c2e5dde92601
SHA51223700161d33698b09f23a1a7db51de3d07483ad69136e216becd68cd33392be6e9f26738995145e607ec81beb7a5ea11dd4fe03cf8e07158ab418d3035d072a2
-
Filesize
322B
MD5c0a293198977a927f377555aef6f54c0
SHA1153ca3a9a74cceebe185bb13c28b28b590ffa603
SHA256cd06d606bc005c4ea96a0ca3daadc189e16320c60dbeb79d74da981915ccf23e
SHA512e8a10278a25c43a422589f0e8c4234b9a6b046266583ef5b38c900f633e0af4d43ef2cf0b74142e30e6a56ed74c3af5962df7cd6dfc3eb2746afe0ec1c62dead
-
Filesize
2.1MB
MD5a068280a4398e466390f79eb2bbcc4ee
SHA1bc66e06200d1ed384797303842dbac68aed206fc
SHA2568a77a81934fd75f51335d067df26450f3abbdf4251530bcbed61d1805a622ce4
SHA51291322036fd7930000eb0347d7024dfd479cbc4f3c2e9ddc322a5e21ae2c9796abd03b22f496dbdd5d0ab290374504fb128f8addf827b1b0f9925fb29a4a85b9b
-
Filesize
1KB
MD5cdd7f67a650eb01968a541900bd09a9a
SHA16a8a34da4690316b4b68ae1d69789a18dab1d4d5
SHA25607bbe85dd294425bc3510adfe7ef0a6d570ee0a024307e9806cb8b362e29a2cb
SHA5123b182a3a0a5774e22b2eca9cb428f13a10e99a1657b99c1a3863a4fe0ac85a66f71df8d20a2996dc2d45b52d5305c7de11b5ff9d65ab707520b3df433d17ede4
-
\Users\Admin\AppData\Local\Temp\c13c0f88d69f72c9bce3f695c5f3614a0b920d516e2c3c70be297c1688fd141b.exe
Filesize384KB
MD54fd8599e74c8a1426c067cec9ca62644
SHA19b5d9929dca9e1b28b4d5615a7d49666ab7cef46
SHA256f759ae5d7ad5247cc2d9edd27a8c3798dd9ae87c443ef7b11e992848bb228ec2
SHA5128ba54fc1540d438b5546dc4f531e0ebee881ca29bc1c13beff390d13574bc1f84726ad1192cc12a988d457683f684b7d072761a94bf41aa621138ea6cbbb84fb