Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 00:51
Static task
static1
Behavioral task
behavioral1
Sample
37b71289f7b3c9a249a468da3325dae0N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37b71289f7b3c9a249a468da3325dae0N.exe
Resource
win10v2004-20240709-en
General
-
Target
37b71289f7b3c9a249a468da3325dae0N.exe
-
Size
69KB
-
MD5
37b71289f7b3c9a249a468da3325dae0
-
SHA1
4e83ce31c2b92a76e0980d1281fc66ecf5c31d45
-
SHA256
fbc56fe70a55e9c373e0874369c688f895b290f16d677bab8bea4ff2261563ef
-
SHA512
ab56b572080fc70ecbab0f53957b5616a85ec104bd485aa559e1d1e87d2b8f612c2f3e6c5eabce5d06d5ca0ce0b92169cde2615a55128a88a97df22d461608c1
-
SSDEEP
768:EOUWtMYkEOW16YRm/CSEAemLTl0eJpigKqk58sCuSfWV/cXMscAybZAhfmNP+L:9U9YkETRm/CQTN7igW58kSASMHp7NPK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3044 upsec.exe -
Loads dropped DLL 1 IoCs
pid Process 2388 37b71289f7b3c9a249a468da3325dae0N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2388 wrote to memory of 3044 2388 37b71289f7b3c9a249a468da3325dae0N.exe 30 PID 2388 wrote to memory of 3044 2388 37b71289f7b3c9a249a468da3325dae0N.exe 30 PID 2388 wrote to memory of 3044 2388 37b71289f7b3c9a249a468da3325dae0N.exe 30 PID 2388 wrote to memory of 3044 2388 37b71289f7b3c9a249a468da3325dae0N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\37b71289f7b3c9a249a468da3325dae0N.exe"C:\Users\Admin\AppData\Local\Temp\37b71289f7b3c9a249a468da3325dae0N.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\upsec.exe"C:\Users\Admin\AppData\Local\Temp\upsec.exe"2⤵
- Executes dropped EXE
PID:3044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD5ffeab2a202fa7953f68ffc2461fc76f8
SHA1394abfa90fd219d72da54aa024fa2d639c783f8a
SHA2567d6ba397bcfffe0ec9da4305d1a6749da01b692362b5fc8193a29dccaad2d5ad
SHA512866197f9d17dea4f7f93e332c13c592eace7b542de33644bb943f524f66e3dd878fe1a395a107c7a81f50c6750d79cd1fece9e92489bc647deef9440adc95eb3