Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240802-en
General
-
Target
main.exe
-
Size
29.0MB
-
MD5
512314609691d02f2ff9307304b5dc8d
-
SHA1
6ea8a173e3b8bc05df0679e9faeb6d8e9a536027
-
SHA256
370c0eee8d2ff44b4ec5c164911329adef00375db73d2bc3a232a387a8865aad
-
SHA512
42da6b50f18321313258a75a8bf6ea721592fed65e197eaadd4ea32cf4e142183b788c8e7519e418bdfd5be5dddd619169d61d9d9414f006fe4ac5c340d88fc9
-
SSDEEP
786432:FG7FLtmULcWZp/nw2P+W8+uxIZ8aDB+RHdZtdSbT:CyWj/w2O39siHdvOT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2724 main.exe -
Loads dropped DLL 2 IoCs
pid Process 2060 main.exe 2724 main.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2060 main.exe 2060 main.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2724 2060 main.exe 31 PID 2060 wrote to memory of 2724 2060 main.exe 31 PID 2060 wrote to memory of 2724 2060 main.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\onefile_2060_133684728446196000\main.exeC:\Users\Admin\AppData\Local\Temp\main.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD558e01abc9c9b5c885635180ed104fe95
SHA11c2f7216b125539d63bd111a7aba615c69deb8ba
SHA256de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
SHA512cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081