Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
cs+changer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cs+changer.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
loader-o.pyc
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
loader-o.pyc
Resource
win10v2004-20240709-en
General
-
Target
cs+changer.exe
-
Size
57.2MB
-
MD5
4f89f4e58160db47d19260b5f9de9bca
-
SHA1
9599c5e021195c4b9355f2bf6e59a6067379cfc1
-
SHA256
50259bd5d39e1d33d5ca3250ba67333c57c11c08959d237404166b4356572aa6
-
SHA512
d5682ae141f3e241967859bd3dbf99eda859bf3d89032457141b1372dc4d540c244a48aab8ba64aa2d3be64691a5c6f8fcaab75086d7ec3307bc0170300a364b
-
SSDEEP
1572864:qxB7vFQqMrlpA+Ql4VdIvIe6MqQZ19Wb84xhvsZ:qxBJyklAIvNF/9e8ehM
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2384 cs+changer.exe -
resource yara_rule behavioral1/files/0x000300000002089c-1672.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2384 2180 cs+changer.exe 31 PID 2180 wrote to memory of 2384 2180 cs+changer.exe 31 PID 2180 wrote to memory of 2384 2180 cs+changer.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"C:\Users\Admin\AppData\Local\Temp\cs+changer.exe"2⤵
- Loads dropped DLL
PID:2384
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2380
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD58f165bfadf970edafd59067ad45a3952
SHA116c1876f2233087156b49db35d4d935c6e17be6a
SHA25622470af77229d53d9141823c12780db63c43703dd525940bc479730d2e43513d
SHA512b3af95dc9a68e21e8eca98e451b935f72663c2552ebf26de299716f17193f238d55c292df953d641defcbcec3ea18eb37cd4b839800804efa8f40658427263ae
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1