Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 18:37
Static task
static1
Behavioral task
behavioral1
Sample
0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe
Resource
win10v2004-20240508-en
General
-
Target
0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe
-
Size
26KB
-
MD5
55695b062d3b7ba38faa0c4e2fbf80d5
-
SHA1
b568062209dfd46aab41870f2a2b27c65becdc9e
-
SHA256
0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088
-
SHA512
097a5839d2f430823c01603185c5be9755bab28c460e6b4ec701f5ebd56d9f86d41f4734680a5547f67cb287da639436ea13ee84d903a02ede6a5727ce306d72
-
SSDEEP
384:B5FZdgAkTiM79mgL2RCvVhRF19c4BCal0/U8hRF1hxKSO:d3M7Yu2RYpF19L+/F15O
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 3 IoCs
pid Process 2668 timeout.exe 2588 timeout.exe 2332 timeout.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 108 wrote to memory of 2916 108 0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe 28 PID 108 wrote to memory of 2916 108 0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe 28 PID 108 wrote to memory of 2916 108 0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe 28 PID 108 wrote to memory of 2916 108 0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe 28 PID 2916 wrote to memory of 2608 2916 cmd.exe 30 PID 2916 wrote to memory of 2608 2916 cmd.exe 30 PID 2916 wrote to memory of 2608 2916 cmd.exe 30 PID 2916 wrote to memory of 2608 2916 cmd.exe 30 PID 2916 wrote to memory of 2620 2916 cmd.exe 31 PID 2916 wrote to memory of 2620 2916 cmd.exe 31 PID 2916 wrote to memory of 2620 2916 cmd.exe 31 PID 2916 wrote to memory of 2620 2916 cmd.exe 31 PID 2916 wrote to memory of 2668 2916 cmd.exe 32 PID 2916 wrote to memory of 2668 2916 cmd.exe 32 PID 2916 wrote to memory of 2668 2916 cmd.exe 32 PID 2916 wrote to memory of 2668 2916 cmd.exe 32 PID 2916 wrote to memory of 2588 2916 cmd.exe 33 PID 2916 wrote to memory of 2588 2916 cmd.exe 33 PID 2916 wrote to memory of 2588 2916 cmd.exe 33 PID 2916 wrote to memory of 2588 2916 cmd.exe 33 PID 2916 wrote to memory of 2332 2916 cmd.exe 34 PID 2916 wrote to memory of 2332 2916 cmd.exe 34 PID 2916 wrote to memory of 2332 2916 cmd.exe 34 PID 2916 wrote to memory of 2332 2916 cmd.exe 34 PID 2916 wrote to memory of 2624 2916 cmd.exe 35 PID 2916 wrote to memory of 2624 2916 cmd.exe 35 PID 2916 wrote to memory of 2624 2916 cmd.exe 35 PID 2916 wrote to memory of 2624 2916 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe"C:\Users\Admin\AppData\Local\Temp\0b428ee31ae85fed58dc06824671823e7e413027cfe8888eb620459d92b16088.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\24CF.tmp\batchfile.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\chcp.comchcp 650013⤵PID:2608
-
-
C:\Windows\SysWOW64\mode.commode 80,153⤵PID:2620
-
-
C:\Windows\SysWOW64\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
PID:2668
-
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:2588
-
-
C:\Windows\SysWOW64\timeout.exetimeout 23⤵
- Delays execution with timeout.exe
PID:2332
-
-
C:\Windows\SysWOW64\mode.commode 130,303⤵PID:2624
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD540da5049abcab02a747c57d1ed8cf512
SHA174b6d7cd149bdf61abebb512aa89252bde8cd0bd
SHA25645c6138928d29ed3e234bde22bf7d5288254c94df958a19fa57ed49a68ba1562
SHA512f5bf93f08b76e670637c3de2820bdfa334c475f8a072c4ffafaac332383f750216dbff589d3377cdb9afe009f0db7ecb25fd923497da089dc26c5e96c28c4a9a