Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
10/05/2024, 00:01
General
-
Target
8b96004837574e781ed210dc062731940218aba1922fffa71ccf4eebc7b7835e.exe
-
Size
500KB
-
MD5
339c3b8929221baab27a3ed076c42c65
-
SHA1
6e1ffd24df574a5fea267f89ef3e6042a8b3a7c7
-
SHA256
8b96004837574e781ed210dc062731940218aba1922fffa71ccf4eebc7b7835e
-
SHA512
290e237071a438259567164b77996807f64d4701584240572fac791864d34bec4e7d01326930ff8b85dbf5759c8b502f751d80680fd50f73d757f53e70f8415e
-
SSDEEP
12288:8WBm+95nHfF2mgewFx5C07D61uVmR74pxJ1kfgjdkA:8WBz95ndbgfx5C0rVHUgjT
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b96004837574e781ed210dc062731940218aba1922fffa71ccf4eebc7b7835e.exe"C:\Users\Admin\AppData\Local\Temp\8b96004837574e781ed210dc062731940218aba1922fffa71ccf4eebc7b7835e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\146B.tmp"C:\Users\Admin\AppData\Local\Temp\146B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\8b96004837574e781ed210dc062731940218aba1922fffa71ccf4eebc7b7835e.exe 173A65563A2532313A9A21D985899302CF7145AC15C3E9FCB7982B94DE15C90C62318CBCA0B953B967BA53BC88F87BCD487EFF6925A0916D92234CB0437B321C2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500KB
MD55114c8b23b43478bd05457c9dc93682a
SHA181868d93672806184a4e2c6e74cd7f5a978d32b7
SHA2566fd1681950f538c21ae79de721a13767b7929428c673a793bcdd6c4fd5da9107
SHA512508c52bafd98d599e6b2ab2aeaea10854db5d0ef559d61e49e2ebd415771e6f712a95fb2381ddf7567518ddfa77349aee407457a7a9fd70185b22a2dce4e9349
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB