Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 11:57
Behavioral task
behavioral1
Sample
New folder (5)/Loader/Gui Connect.js
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
New folder (5)/Loader/Gui Connect.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
New folder (5)/QllzgR.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
New folder (5)/QllzgR.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
New folder (5)/Skin Changer.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
New folder (5)/Skin Changer.exe
Resource
win10v2004-20240802-en
General
-
Target
New folder (5)/Skin Changer.exe
-
Size
12.2MB
-
MD5
61c842c4a5405955777dedab86174b67
-
SHA1
c90ae53beec6a847ab13db03156f4661361a9918
-
SHA256
33c0c309dba1ae1539b6e49b881f1abb5679ffcabf84fda8e5a4d52f588aa0a8
-
SHA512
b4376d9544cf7f280aad0c81462b954fd11cb9e6fedee6b71b48439866480a6d530c34d51f1cfa3aea096af2a123f2b3a112f1aa55f1699f720a14d82fa5cf4b
-
SSDEEP
393216:AQdqtWL01+l+uq+VvedQJlewF3MnG3xl5lcgGLrlcTuOs:AqCq01+l+uqgvedQT3MGxdZ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2692 Skin Changer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 984 wrote to memory of 2692 984 Skin Changer.exe 29 PID 984 wrote to memory of 2692 984 Skin Changer.exe 29 PID 984 wrote to memory of 2692 984 Skin Changer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\New folder (5)\Skin Changer.exe"C:\Users\Admin\AppData\Local\Temp\New folder (5)\Skin Changer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\New folder (5)\Skin Changer.exe"C:\Users\Admin\AppData\Local\Temp\New folder (5)\Skin Changer.exe"2⤵
- Loads dropped DLL
PID:2692
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b