Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
10/07/2024, 19:15
Static task
static1
Behavioral task
behavioral1
Sample
pcdocpro.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
pcdocpro.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240709-en
General
-
Target
pcdocpro.exe
-
Size
3.6MB
-
MD5
2ee54a18ebfa25d64707da0a5a55c822
-
SHA1
f6cf1a79d2cb576ef51a4f9511edcf052bfa9bbc
-
SHA256
2117d2d4354a204d7be1221847348735dabf79b82501a87c4179a288a5cbeae5
-
SHA512
fb080210d4c9ab4c8817d459244dc1336cbecc08eb135df0009811749a2ecbd45b631f845788f747012515f7c7b7b216c52d5b27869f05d1ce238189d72f39c4
-
SSDEEP
98304:hbaf3lvQ4oNLBodPauu4hL3KLorSMGyX:8f4LBowunLrSM7
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2888 d_pcdocpro.exe 2540 d_pcdocpro.tmp -
Loads dropped DLL 6 IoCs
pid Process 2548 pcdocpro.exe 2888 d_pcdocpro.exe 2888 d_pcdocpro.exe 2888 d_pcdocpro.exe 2540 d_pcdocpro.tmp 2540 d_pcdocpro.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2540 d_pcdocpro.tmp -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2888 2548 pcdocpro.exe 30 PID 2548 wrote to memory of 2888 2548 pcdocpro.exe 30 PID 2548 wrote to memory of 2888 2548 pcdocpro.exe 30 PID 2548 wrote to memory of 2888 2548 pcdocpro.exe 30 PID 2548 wrote to memory of 2888 2548 pcdocpro.exe 30 PID 2548 wrote to memory of 2888 2548 pcdocpro.exe 30 PID 2548 wrote to memory of 2888 2548 pcdocpro.exe 30 PID 2888 wrote to memory of 2540 2888 d_pcdocpro.exe 31 PID 2888 wrote to memory of 2540 2888 d_pcdocpro.exe 31 PID 2888 wrote to memory of 2540 2888 d_pcdocpro.exe 31 PID 2888 wrote to memory of 2540 2888 d_pcdocpro.exe 31 PID 2888 wrote to memory of 2540 2888 d_pcdocpro.exe 31 PID 2888 wrote to memory of 2540 2888 d_pcdocpro.exe 31 PID 2888 wrote to memory of 2540 2888 d_pcdocpro.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\pcdocpro.exe"C:\Users\Admin\AppData\Local\Temp\pcdocpro.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\ESWB9AE.tmp\d_pcdocpro.exeC:\Users\Admin\AppData\Local\Temp\ESWB9AE.tmp\d_pcdocpro.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\is-L1D5S.tmp\d_pcdocpro.tmp"C:\Users\Admin\AppData\Local\Temp\is-L1D5S.tmp\d_pcdocpro.tmp" /SL5="$5001C,3432464,53248,C:\Users\Admin\AppData\Local\Temp\ESWB9AE.tmp\d_pcdocpro.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2540
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba
-
Filesize
3.5MB
MD521970ee3c2744d6040aafdd6e232d485
SHA18ce5b38ef399178c0ba3b46f1bad8d33bccd8d32
SHA256118fcc7d6e80974e70fd4fbfc7e02fe50b48271dbcfe9458c6024c131fe6ebfe
SHA5126d06f9baccb996236a6273ebecbc22a42a93a83e64da029bba917820eb9281ab9cf6a7a5a2fd937ee88d9fbcfdbafa1c53e08e526b95d8f4e38e2861e928edfa
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3