Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
23/05/2024, 19:02
General
-
Target
190ef39de605ecf47f0386bd29c831318d306704157a629d17a4f5a584b80a0d.exe
-
Size
5.4MB
-
MD5
c7101493d21b2c1766e8568fbde848cd
-
SHA1
05074d80430d3685ec63578d2147fdef855042f5
-
SHA256
190ef39de605ecf47f0386bd29c831318d306704157a629d17a4f5a584b80a0d
-
SHA512
616062398170106465caee5f1183c50eac93f03d3f62fb1cb293d9e6766e1d62044980c6e9cef7803457fdea2c5117da91e4c4380777c90ef4f9943acecf007a
-
SSDEEP
98304:emhd1Uryek9irB7V7wQqZUha5jtSyZIUh:elE92B72QbaZtliU
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\190ef39de605ecf47f0386bd29c831318d306704157a629d17a4f5a584b80a0d.exe"C:\Users\Admin\AppData\Local\Temp\190ef39de605ecf47f0386bd29c831318d306704157a629d17a4f5a584b80a0d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1140.tmp"C:\Users\Admin\AppData\Local\Temp\1140.tmp" --splashC:\Users\Admin\AppData\Local\Temp\190ef39de605ecf47f0386bd29c831318d306704157a629d17a4f5a584b80a0d.exe 973407901F46B013AF73EF8B9602A0E5EB595C4794499BD98464920B61FAF2745BA00F834B2B0437D291BAF09AACF6BF334551E0EB4AEFE05E0C264BB1086D4B2⤵
- Deletes itself
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD5afffa9967376f5cf01e57c5a1a33d0cc
SHA1784d83ee717f0b88fca86cdcde6eaea38b012a2a
SHA2564b9d5fea306e173bf72e59988c3d84159a6a61da5630c671f0adac432f476eab
SHA51201281f4cc4d7cc47f31e8177270013f1ed3714e518c6b63f149c6951f8efef26a717104c795600804334bfa2b3fb86f097c9a46fb1ab2dab36c049fe43cdd6ce
-
Filesize
4.3MB
-
Filesize
4.3MB