Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
07/07/2024, 03:54
Behavioral task
behavioral1
Sample
cf820817ac61842aa0429fc4b8977ef8.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
cf820817ac61842aa0429fc4b8977ef8.exe
Resource
win10v2004-20240704-en
General
-
Target
cf820817ac61842aa0429fc4b8977ef8.exe
-
Size
11.2MB
-
MD5
cf820817ac61842aa0429fc4b8977ef8
-
SHA1
8783d4d2f3d1daee97cab7a3e4ea681698732064
-
SHA256
bc453d4ef66b8f580897308af2cccbebeb2423c008a2b7bcea0483bd021714ec
-
SHA512
470c23c6d8ff537e524191ac7b0ceffca959162a73e810d45aa06ad0dc6c6b52ed887c270f0cc7f15f0b4251625ff70205dcdd99785914264f775ccaca4e317e
-
SSDEEP
196608:wXcisRkFC/PAgtSwLRXgWPmpzdhqiUeNvX+wfm/pf+xfdkRpjHKsnzruOZW0D+qI:risHAgt5L1V8dvvX+9/pWFGRBqsnzrul
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2584 cf820817ac61842aa0429fc4b8977ef8.exe -
resource yara_rule behavioral1/files/0x00050000000193cf-48.dat upx behavioral1/memory/2584-50-0x000007FEF61A0000-0x000007FEF6788000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2584 2728 cf820817ac61842aa0429fc4b8977ef8.exe 30 PID 2728 wrote to memory of 2584 2728 cf820817ac61842aa0429fc4b8977ef8.exe 30 PID 2728 wrote to memory of 2584 2728 cf820817ac61842aa0429fc4b8977ef8.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf820817ac61842aa0429fc4b8977ef8.exe"C:\Users\Admin\AppData\Local\Temp\cf820817ac61842aa0429fc4b8977ef8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\cf820817ac61842aa0429fc4b8977ef8.exe"C:\Users\Admin\AppData\Local\Temp\cf820817ac61842aa0429fc4b8977ef8.exe"2⤵
- Loads dropped DLL
PID:2584
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45