Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/06/2024, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe
Resource
win10v2004-20240508-en
General
-
Target
02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe
-
Size
7.5MB
-
MD5
21d4206468be0051cc5ff4fb62877663
-
SHA1
04bdc5844cfea502f9c7ada4fa30de20d09ed245
-
SHA256
02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a
-
SHA512
ce83be5c1d8f7700ecc467597304d966ce382dd56b7ac59d3b5890191045be4e19dd3d81ff034dd8d04894531af077d5299be706cbf1745fdcba52a902a204c6
-
SSDEEP
98304:emhd1Urye4OfLvJaj0D8LUDh0V7wQqZUha5jtSyZIUbQ:elnDnA2QbaZtlix
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2816 32E3.tmp -
Executes dropped EXE 1 IoCs
pid Process 2816 32E3.tmp -
Loads dropped DLL 2 IoCs
pid Process 2664 02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe 2664 02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2816 2664 02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe 28 PID 2664 wrote to memory of 2816 2664 02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe 28 PID 2664 wrote to memory of 2816 2664 02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe 28 PID 2664 wrote to memory of 2816 2664 02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe"C:\Users\Admin\AppData\Local\Temp\02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\02e40f560d5fd4b6869aecd06a2f61a8b06d396b4f75db8d92cc7d7291b2d44a.exe 365AC4EB2CF3633672E99405C7388D4B59477432DDF1C254406B491CA7067BA9A054BF5B77EF08EE30FC0188FC2DFBBEDD401C02106C1718841EF97B1E82657F2⤵
- Deletes itself
- Executes dropped EXE
PID:2816
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.5MB
MD55f087562f2677fec126e71149c599543
SHA1d835bf97753c56f654b260b6b0f85935b271bd14
SHA2565156247cf33d1e11f1d848c6bb8ca1a8ee9dd26e9461a116aa2d8626f6bf34f8
SHA512119251c36089b90cc48e0f7292f1ffff3f0cbcdf482c67cd41e1c369860fd2df5c8626f9ae2093ba585d33312ce5f6e84a65b8ef6ee5e63c1b47bf488c9a7236