Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
Resource
win10v2004-20240611-en
General
-
Target
32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
-
Size
1.9MB
-
MD5
030d58d0aff7a29efcbdc3febbfb3fd3
-
SHA1
f8dcc35da70fde2a08ef29222b0fed7f3f47c810
-
SHA256
32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6
-
SHA512
5153e247f1661476ea2a1d2f339873da61f244c10c20fa37c7ffe17d8df368e3f5cfa33a285909e2cc3dd7978ea595890668627f6b1cdf2d4e2f0c531eeaf78f
-
SSDEEP
49152:hltvubm454AdBubRZh3i7HgXgJbNsm+kwjI4TT86lorJ:hrvb4xButGFZshK4n86WrJ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2512 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe -
Executes dropped EXE 1 IoCs
pid Process 2512 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe -
Loads dropped DLL 1 IoCs
pid Process 2324 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 pastebin.com 4 pastebin.com -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2512 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2324 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2512 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2512 2324 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe 29 PID 2324 wrote to memory of 2512 2324 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe 29 PID 2324 wrote to memory of 2512 2324 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe 29 PID 2324 wrote to memory of 2512 2324 32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe"C:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exeC:\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
PID:2512
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\32add71d552951286bae14a2dbdb75ad8f9a3fe212c5369a91158ef60d1c12c6.exe
Filesize1.9MB
MD56878618a9fd8c1a486d38db03d1cf118
SHA1321ce6478330b155c4004ea9c5f483810246f762
SHA256c6947100050a3eeab62f21abc067a02593f84e957932b40defef8791928415f5
SHA512122bbcf0e3f408a37007b301a4a353c6442287b937f874d0add75aa4c469dcf0301063c10f57e21f355b8ea4e7898665e783243e0acafc75d59f097a1ef3c687