Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31/05/2024, 02:36
Static task
static1
Behavioral task
behavioral1
Sample
820805a7ff0979481275bf1bd3b1b4f9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
820805a7ff0979481275bf1bd3b1b4f9.exe
Resource
win10v2004-20240508-en
General
-
Target
820805a7ff0979481275bf1bd3b1b4f9.exe
-
Size
153KB
-
MD5
820805a7ff0979481275bf1bd3b1b4f9
-
SHA1
6b0e02f92706f4918d25e332bf497e60cc6a1fe6
-
SHA256
984daa96d2ae4ba3a2cf118ec7cf2d5423bc9ea4da2898287b4ea1a2e39cac49
-
SHA512
9a99469ab99f4f6500393eca08d3321bcbaa11497dd33521f16f688e0db41b4749bde255d3534d54f0ff9fab20af82cc8dbb702be4215f5cc133b40ea5957d24
-
SSDEEP
3072:vCQHshN8TmQ+fG6V+kr9d+TpvDbTDp1BsSnt3I3ZdnEPn/:NshzQ+5VX+TpHHiSt3I3Zm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2328 820805a7ff0979481275bf1bd3b1b4f9.exe -
Loads dropped DLL 2 IoCs
pid Process 2012 820805a7ff0979481275bf1bd3b1b4f9.exe 2012 820805a7ff0979481275bf1bd3b1b4f9.exe -
resource yara_rule behavioral1/files/0x0008000000015d67-6.dat upx behavioral1/memory/2012-8-0x0000000002A30000-0x0000000002A69000-memory.dmp upx behavioral1/memory/2328-15-0x0000000000400000-0x0000000000439000-memory.dmp upx behavioral1/memory/2328-17-0x0000000000400000-0x0000000000439000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2328 2012 820805a7ff0979481275bf1bd3b1b4f9.exe 28 PID 2012 wrote to memory of 2328 2012 820805a7ff0979481275bf1bd3b1b4f9.exe 28 PID 2012 wrote to memory of 2328 2012 820805a7ff0979481275bf1bd3b1b4f9.exe 28 PID 2012 wrote to memory of 2328 2012 820805a7ff0979481275bf1bd3b1b4f9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\820805a7ff0979481275bf1bd3b1b4f9.exe"C:\Users\Admin\AppData\Local\Temp\820805a7ff0979481275bf1bd3b1b4f9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\Temp\MT\820805a7ff0979481275bf1bd3b1b4f9.exe"C:\Windows\Temp\MT\820805a7ff0979481275bf1bd3b1b4f9.exe"2⤵
- Executes dropped EXE
PID:2328
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD59311f139732df2f8c594de65105c3d1b
SHA128e8bccf6392bac26a85dd14762e8981dce17b84
SHA256cede15606163cddd1c1cddd2573a4a4782a63614c9c43d2427db0ce6f2ab7392
SHA51254bfaba067bfbc5e75ddbc1a9a80ad7832a60fa8c72ff615d464330e466ef0984305d7957336670bdeabe98b271b21f6202b13ab94fe7e88b48b938982bc73d6