Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20240802-en
General
-
Target
Bootstrapper.exe
-
Size
54.3MB
-
MD5
1754cf1d3b2e6d9577f33335e50b9d93
-
SHA1
179d5211d75f0683c611db7c6010653d8293d9c9
-
SHA256
d1ea2786f6666b66768972455069617615b1ce5779516630f27e2ef6622a4200
-
SHA512
4404abc5861b0cf48b506277c57a63c2132f8248d8a951b296589a721405ac3760adf47ec97252a2fcfc15e47604a423e2b5682adec334ddcb0d8f5617d86783
-
SSDEEP
1572864:IIB7vFQqMrlpA+Ql4Jd2vIe6MqiyrTjoj:IIBJyklm2vNFSr3w
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2740 Bootstrapper.exe -
resource yara_rule behavioral1/files/0x000300000002083d-835.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2740 2544 Bootstrapper.exe 30 PID 2544 wrote to memory of 2740 2544 Bootstrapper.exe 30 PID 2544 wrote to memory of 2740 2544 Bootstrapper.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"2⤵
- Loads dropped DLL
PID:2740
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5ca67f0baf3cc3b7dbb545cda57ba3d81
SHA15b4e36aef877307af8a8f78f3054d068d1a9ce89
SHA256f804ed205e82003da6021ee6d2270733ca00992816e7e89ba13617c96dd0fba3
SHA512a9f07dd02714c3efba436326425d443969018ace7ebd7cc33c39d43e3d45480a4fcd4c46c09ad132b4f273888f13e9f598de257130429fcb2519c000e4fab6f7
-
C:\Users\Admin\AppData\Local\Temp\_MEI25442\setuptools\_vendor\backports.tarfile-1.2.0.dist-info\INSTALLER
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1