Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 14:44
Behavioral task
behavioral1
Sample
SiberiaProgDriver.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SiberiaProgDriver.exe
Resource
win10v2004-20240802-en
General
-
Target
SiberiaProgDriver.exe
-
Size
17.6MB
-
MD5
07df29e05e2c11644c48bba28d5e7df8
-
SHA1
b5e27732707d931249fc3e4d1e2cc9f31558d07c
-
SHA256
0c5720fb2a64cc6b0ff1503c01bc3f3192b0f9f5109dace56347824de80c84fc
-
SHA512
9b48a9cdaf5f7718512ba4a0cdde32c644efc7053c44c69e16bb9425a2d656f9f4c193b48708b762156f93876591f0c763878962dc50f0bc4ea39a74cb2fd70f
-
SSDEEP
393216:p3EkNZJlhZ2YsHFUK2Jn1+TtIiFqCuARuAUFXmvJyi9Irs7O/:1FnZ2YwUlJn1QtI1CuAEIJyPZ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2900 SiberiaProgDriver.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2900 1812 SiberiaProgDriver.exe 30 PID 1812 wrote to memory of 2900 1812 SiberiaProgDriver.exe 30 PID 1812 wrote to memory of 2900 1812 SiberiaProgDriver.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\SiberiaProgDriver.exe"C:\Users\Admin\AppData\Local\Temp\SiberiaProgDriver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\SiberiaProgDriver.exe"C:\Users\Admin\AppData\Local\Temp\SiberiaProgDriver.exe"2⤵
- Loads dropped DLL
PID:2900
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD5387bb2c1e40bde1517f06b46313766be
SHA1601f83ef61c7699652dec17edd5a45d6c20786c4
SHA2560817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
SHA512521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
-
C:\Users\Admin\AppData\Local\Temp\_MEI18122\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
Filesize
1023B
MD5141643e11c48898150daa83802dbc65f
SHA10445ed0f69910eeaee036f09a39a13c6e1f37e12
SHA25686da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
SHA512ef62311602b466397baf0b23caca66114f8838f9e78e1b067787ceb709d09e0530e85a47bbcd4c5a0905b74fdb30df0cc640910c6cc2e67886e5b18794a3583f
-
Filesize
92B
MD543136dde7dd276932f6197bb6d676ef4
SHA16b13c105452c519ea0b65ac1a975bd5e19c50122
SHA256189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
SHA512e7712ba7d36deb083ebcc3b641ad3e7d19fb071ee64ae3a35ad6a50ee882b20cd2e60ca1319199df12584fe311a6266ec74f96a3fb67e59f90c7b5909668aee1