Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
RuntimeBrokerVers.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RuntimeBrokerVers.exe
Resource
win10v2004-20240802-en
General
-
Target
RuntimeBrokerVers.exe
-
Size
13.1MB
-
MD5
197a1e583ca110d62ff0d47fdb966f75
-
SHA1
0a3e22480bbc64a62dcf2aff46b786c349eb5cf2
-
SHA256
66ade039cb8cba332bc00e7cf3b0315ff8f78417b0f44150fb1b657677cd2958
-
SHA512
adbc41fd702d842c61d007a4ade09358d628b64586c19d04769d0d47a3ca804f058865a7f8a435a2255a15da6d5219e9809f726e08b19b49fa71e54cb534180b
-
SSDEEP
196608:e4z5aWpRNf+IJs/WP6eOEXdb8F9JRGoUbH6pm+TeDN99EQRDcegSDm5YTW68iS0Q:/hpR0IJ9P6eO2dboBUs8+YLgzqCUxwS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2732 RuntimeBroker.exe -
Loads dropped DLL 2 IoCs
pid Process 1924 RuntimeBrokerVers.exe 2732 RuntimeBroker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2732 1924 RuntimeBrokerVers.exe 30 PID 1924 wrote to memory of 2732 1924 RuntimeBrokerVers.exe 30 PID 1924 wrote to memory of 2732 1924 RuntimeBrokerVers.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBrokerVers.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBrokerVers.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\onefile_1924_133701671893614000\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBrokerVers.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD55a5dd7cad8028097842b0afef45bfbcf
SHA1e247a2e460687c607253949c52ae2801ff35dc4a
SHA256a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
SHA512e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858
-
Filesize
23.3MB
MD58530bcffbcd37c8a067297f082183876
SHA1efb9be0f7eea1d791a5b0722b9f87f2836267857
SHA2567ff988010d505d3f6b3dd98acade0421db0df53c93cab9d9c27779e956b3c597
SHA5127de5b7da93a8a24240b1cdbbbb302c3080d89f26a13ef44c3164d2308abf8168b887a36e77a4b03bd0e4cdd9c5415e524a08509e0e5aa3d3e0add5dfe0fd27d3