Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe
Resource
win10v2004-20240802-en
General
-
Target
d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe
-
Size
51KB
-
MD5
28365c777d2437c7cb44be6953a21bfa
-
SHA1
db81e9981f1bb49d4422ae34385751549939d4f3
-
SHA256
d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60
-
SHA512
e54a74755255e33e645f098a499bad12f453d6cc56744208d6b147a5de358f992acbb31af83b0d16566a5c882f7e14ddc9af5aefd55d1cf1963b22214326c6cf
-
SSDEEP
1536:d2jXRrs9sINeZEtejlIkoLN127BFVn2p4lAnZ8gIux9Mz+E6P8+kzCzJ:d2jXRrs9sINeZEtejlIkoLN127BFVn2F
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2696 trueupdater.exe -
Loads dropped DLL 1 IoCs
pid Process 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trueupdater.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2696 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe 30 PID 2644 wrote to memory of 2696 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe 30 PID 2644 wrote to memory of 2696 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe 30 PID 2644 wrote to memory of 2696 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe 30 PID 2644 wrote to memory of 2696 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe 30 PID 2644 wrote to memory of 2696 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe 30 PID 2644 wrote to memory of 2696 2644 d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe"C:\Users\Admin\AppData\Local\Temp\d007e15b425afbe8550b3e63905e88aebb9e7dab4be628df68d2360526acfc60.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"C:\Users\Admin\AppData\Local\Temp\trueupdater.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD58b23ce87f0b54a49181e1a9d61e44655
SHA156afc237c69a25b302ea062a4433568b8cedd31d
SHA256e8dd769d73bf3763a04ac81282f41d1783f5ad05fb956013e061fe86d758babd
SHA512d90969863840dab580511f7c3db5aed75e2ca8865e67bf70c11244f16c5fd757e6da3d7c35d5118426c07c5fdbcdf5d4316b445e2d2b085a1a831e101ed7f307