Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
7a04118012045becdd097be62c145e00N.exe
Resource
win7-20240729-en
General
-
Target
7a04118012045becdd097be62c145e00N.exe
-
Size
65KB
-
MD5
7a04118012045becdd097be62c145e00
-
SHA1
51bfbdfb5b158492a546a813e9611107d7bad7f6
-
SHA256
7f9200d64a0be596d0c01b1853ff6ef6d3d0799286265a1b95e2e61de611a15c
-
SHA512
5a2a0326aaffbc77606898e9979fb1c96a47762359e74651407eecf4a51e51eec05ea48e4c979815fda16e0a1c11e058691ae800809e90ac949ac7771b75a0ed
-
SSDEEP
768:ErzHIr42KUtWafMjFDWkCO05EsCC/s3NhfAoiDCIElPbAX2n0fjr:Er9ZaidWVOEE3NxweIElDAmnqjr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2616 rmass.exe -
Loads dropped DLL 1 IoCs
pid Process 2716 7a04118012045becdd097be62c145e00N.exe -
resource yara_rule behavioral1/files/0x00070000000120fe-1.dat upx behavioral1/memory/2616-5-0x0000000000400000-0x0000000000412000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\rmass.exe 7a04118012045becdd097be62c145e00N.exe File created C:\Windows\SysWOW64\rmass.exe 7a04118012045becdd097be62c145e00N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a04118012045becdd097be62c145e00N.exe"C:\Users\Admin\AppData\Local\Temp\7a04118012045becdd097be62c145e00N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2716 -
C:\Windows\SysWOW64\rmass.exe"C:\Windows\SysWOW64\rmass.exe"2⤵
- Executes dropped EXE
PID:2616
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD577a4c21fcb8f862e4fe0d8e5dc856e6b
SHA17472cf691767f0988fa485079a0485aaf49d684d
SHA25680dd66cc00249029f4743607aef8d1c2fefb46497dc4a1d3e6e330c58a4debe8
SHA512a3a1c8412b04409f1ba864e13b6559ad3c9299b6c96e42b61252e0d7400b21f52422ac13537a70e075ca9bd3b60a550fc8b540d7a83e05e2507812b6581012de