Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 00:03
Behavioral task
behavioral1
Sample
nitro gen 100% working.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
nitro gen 100% working.exe
Resource
win10v2004-20240709-en
General
-
Target
nitro gen 100% working.exe
-
Size
35.0MB
-
MD5
051b57fdf24082f124d586141f4ccbdf
-
SHA1
1c723d3ce7150c031fa88ce6afebe1be20f37f04
-
SHA256
1081712a1bbf3cd062ff5fda52d5160dce69c707018f698a3bd0dce82be8b5d1
-
SHA512
d2edc1e2829d37d8275f22a542da1f6358744e17514a0f5f3e212243009b2ac7f2e7c618123364a013fddc8feaf6065a7f788d986e3cba2e2285809dc7c346c8
-
SSDEEP
786432:G9C9RbdQA98U+9qJKfzcY87PCirgItW8sl9voxglQL6D:oURZQA9v+3E7IItWfl9KgI6
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 872 nitro gen 100% working.exe 872 nitro gen 100% working.exe 872 nitro gen 100% working.exe 872 nitro gen 100% working.exe 872 nitro gen 100% working.exe 872 nitro gen 100% working.exe 872 nitro gen 100% working.exe -
resource yara_rule behavioral1/files/0x000400000001cf8a-1155.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3040 wrote to memory of 872 3040 nitro gen 100% working.exe 29 PID 3040 wrote to memory of 872 3040 nitro gen 100% working.exe 29 PID 3040 wrote to memory of 872 3040 nitro gen 100% working.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\nitro gen 100% working.exe"C:\Users\Admin\AppData\Local\Temp\nitro gen 100% working.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\nitro gen 100% working.exe"C:\Users\Admin\AppData\Local\Temp\nitro gen 100% working.exe"2⤵
- Loads dropped DLL
PID:872
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD5b38d5b15f77e6cd93763c76ff1bc79ee
SHA1cadffe8a06835a7c1aa136a5515302d80d8e7419
SHA256aa9e41933f1cf1c3bcc3b65771297b0ef088fac153c7997c0d48e7882714d05f
SHA51246eaeb419654efd999146b9cd55ece42939e071f089ccb4698a09f4bb6b881106a3e342901439f867f609c1147ef151832b2919d2a33726643a6e5c4086a5f3a
-
Filesize
22KB
MD5e1d37d21f7875483ae0d187032d5714c
SHA151a945a9e6ccf994781a028cd07ab8ee820f542c
SHA2561076a19f2a42a35c8639fb1ce1666d046e0fd259142f7e645e350211d9d6390f
SHA51277973d6e5e6ad68b304f50184a95be9d4993338f4f69e07c11275951b2fcfdc02c061182d1a7a394dc18fe77d6d021dd9e8e17cdfbbb8d0c77752c6df1979011
-
Filesize
22KB
MD509fed91680050e3149c29cf068bc10e5
SHA1e9933b81c1d7b717f230ea98bb6bafbc1761ec4a
SHA2563c5900c9e7fbada56e86d8973a582771dde6bff79ca80ae05920a33a2cc435df
SHA512e514590385561731f2ad18afd6bcefac012ea8061a40b6ccfda4e45ff5768617b2e1b06e849e8a640a10ca59039e89ba88cac5d3b7ff088968eb4bc78e212d3a
-
Filesize
22KB
MD50f99a725b93375f0ba8795e67e5a4fdf
SHA19825f0ec9cc4ba99471f4587d4bf97f7083d5f93
SHA256be77a15dcaf73a7c1be6c62f57e79ef7bbc305e1b7753a4345ba1d88851dba08
SHA512f95b6472b78f2bea732c6cc4933c83da7cbbf3eec67544b9faf86c6d6183c23e47afadb23e78420ed2dcec7ddde819e0fcb14345614c5acb3d959fca7c5a7468
-
Filesize
22KB
MD5dd86613bbc3da5e41d8bd30803d87c1f
SHA135690b9b0fe48f045568e25221694be041f56d4f
SHA2562312923d7e07c1f58f457ac434b89c01ce675ff42d74bb279326d6c573f675ed
SHA5126d4a29c99e819368389a9347a719e78125dfbc3166af85425db81f38833b57ba28251472dd42db974876bcf8bc73465d638678b06e3482ceb36c19b943f41ca4
-
Filesize
1.6MB
MD59bf00e43c0433304a0028c65811f4e72
SHA122d0b8e761dab4f20692ba12cb669c1aeaa92cf6
SHA25618606849f30ba4abe900e42947ce3b114610810e872755fc2ff327968e0c8dc9
SHA5126bfc19f552662549940674aa290dfdc39b4ca26f159710c1426b1b1a6791dee56bca66ec2974868b6c5e35e97596f937e2dba4ec86419fc447b2586c04758ac0
-
Filesize
1.1MB
MD5a6b4fba258d519da313f7be057435ee4
SHA10bf414057d0749e9db4da7683eb6d11be174cdd5
SHA256aa092722797b9a74e9463516e6c63d4d3c904ac263f4a4ea421b0d4d4875f606
SHA51234f3d006a9bb7835e9d82465874e059a328c8d69abd61c79d6a85a7702df582dabc93126918a0514356fda2810c77acc1d6070ad4418921bd9e8efe34697e4a1