Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe
Resource
win10v2004-20240508-en
General
-
Target
3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe
-
Size
40KB
-
MD5
0dd87583d62fca05908ee79115694763
-
SHA1
a1e1dc6c13c7ff4d58c3e37b76696ac2c54ebb98
-
SHA256
3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5
-
SHA512
c3db458c3a9f0e4295bae9616ecd32a64906290f51493e3c0057b235ddb7cddde1d0f15e73dfa8c04ac987406a384adc2a15a22acce72361ea2e0bb8f43e3cf9
-
SSDEEP
384:pAcTAjVwMatOwS58YwWdFeaeohweCvklV4Viq1cnD/kQzskH4qA1R4Jgl17:pZTAa/OZj74ybzPHzAtl5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1884 budha.exe -
Loads dropped DLL 1 IoCs
pid Process 1152 3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1152 wrote to memory of 1884 1152 3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe 28 PID 1152 wrote to memory of 1884 1152 3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe 28 PID 1152 wrote to memory of 1884 1152 3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe 28 PID 1152 wrote to memory of 1884 1152 3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe"C:\Users\Admin\AppData\Local\Temp\3d37369b210c939234ad0bbd759650b9d32dde7fc3fa69915ca1d7ed4963aae5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\budha.exe"C:\Users\Admin\AppData\Local\Temp\budha.exe"2⤵
- Executes dropped EXE
PID:1884
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD53a6e7d98d3499e3850374f3a7812b8fd
SHA12a47bf03e9b9f8cea4615df5ea18d2f70b95fb86
SHA256913f3c22c1063110f070e8a9cc032887559865f8af44308c965d0bb9f5665463
SHA5123c63625de9c775c2a8214eaee1d8b9adf8c4924b70dd6934c8da04cc95058105d59948ff8df7dc6a19090aababac233e63b8e42c0b7223950c7e0b1d3ffa4d0f