Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
Wave.exe
Resource
win7-20240704-en
General
-
Target
Wave.exe
-
Size
33.4MB
-
MD5
eaaf352176c3b1e0b40f0f57dca55450
-
SHA1
9c70f9fd768ea4170fa1544176bca715d3492078
-
SHA256
1fd3bb3104e2e2acdcf7568a42811804fc8d15e2213062072406ed084064cf7f
-
SHA512
e6d7f8aaaa64316257c045a05fa4fb8a2a57e23fd94c2ff9f447d3f8c8a612ace8e00d6125963ae37e6ffb523baa8c2409ada852229eaaf789e5c93d3fb13d96
-
SSDEEP
786432:19NB7vDydb3+KvIe6WCESWqE5SezZ8vqW8we8M8obiGc73rh0siKV:LNB7v2d9vIe6MqQZ19WbTIiGE0xM
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3040 Wave.exe -
resource yara_rule behavioral1/files/0x000300000002090d-1658.dat upx behavioral1/memory/3040-1660-0x000007FEF6970000-0x000007FEF7034000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2864 wrote to memory of 3040 2864 Wave.exe 30 PID 2864 wrote to memory of 3040 2864 Wave.exe 30 PID 2864 wrote to memory of 3040 2864 Wave.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD58f165bfadf970edafd59067ad45a3952
SHA116c1876f2233087156b49db35d4d935c6e17be6a
SHA25622470af77229d53d9141823c12780db63c43703dd525940bc479730d2e43513d
SHA512b3af95dc9a68e21e8eca98e451b935f72663c2552ebf26de299716f17193f238d55c292df953d641defcbcec3ea18eb37cd4b839800804efa8f40658427263ae
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1