Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 22:48
Static task
static1
Behavioral task
behavioral1
Sample
60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe
Resource
win10v2004-20240704-en
General
-
Target
60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe
-
Size
75KB
-
MD5
966a001eda473cc07c99395b4d196b64
-
SHA1
ac0bb6c3af76aa0974cdbaa60b5436b7fe3a75e4
-
SHA256
60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2
-
SHA512
f5aa9dc3af84ed2b8a7a7c5f22daf8bb349ddfa18be1c0f2045cf42f93ce0ca0a2f4237d6e48803c45048fe8e2db72e30b45424e6fcb4be2f987e127ce5800db
-
SSDEEP
1536:EQTIubHy5wQkNZgHLl7qJc2fiMIRZprDa8ibxBefEc:d4wPNaLlqy2MtDMBIr
Malware Config
Extracted
Protocol: ftp- Host:
ftp.tripod.com - Port:
21 - Username:
onthelinux - Password:
741852abc
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2908 jusched.exe -
Loads dropped DLL 2 IoCs
pid Process 2692 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe 2692 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\e5fe884d\jusched.exe 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe File created C:\Program Files (x86)\e5fe884d\e5fe884d 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe 2908 jusched.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2908 2692 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe 30 PID 2692 wrote to memory of 2908 2692 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe 30 PID 2692 wrote to memory of 2908 2692 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe 30 PID 2692 wrote to memory of 2908 2692 60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe"C:\Users\Admin\AppData\Local\Temp\60466f2e633d503c3fa5dc10a05a7754bbf5540afb6f23ff3c994e3a29dc1ae2.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\e5fe884d\jusched.exe"C:\Program Files (x86)\e5fe884d\jusched.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13B
MD5f253efe302d32ab264a76e0ce65be769
SHA1768685ca582abd0af2fbb57ca37752aa98c9372b
SHA25649dca65f362fee401292ed7ada96f96295eab1e589c52e4e66bf4aedda715fdd
SHA5121990d20b462406bbadb22ba43f1ed9d0db6b250881d4ac89ad8cf6e43ca92b2fd31c3a15be1e6e149e42fdb46e58122c15bc7869a82c9490656c80df69fa77c4
-
Filesize
75KB
MD5ee08373e6824a7907c05e4d2b52440bb
SHA1fdfcbac5cc3d63d582d4065e77a84cfd77be92a9
SHA256e7faa276a65217fa79cdc85702dfc3927a7bd9ca015097706f427162b6f7a023
SHA512a88f9f1aee6dfa5c4c4d9e2e3c1cb6c090e8789d625c2a8e04b2ee4a944031602a914b85a63dc251d190272c980dadec348567f5b2279a8956ba5795359ff575