Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
4s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/09/2024, 17:01
Behavioral task
behavioral1
Sample
sign crushes motorist.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
sign crushes motorist.exe
Resource
win10v2004-20240802-en
General
-
Target
sign crushes motorist.exe
-
Size
80.5MB
-
MD5
d4a4271250b540003b349e43a0d26f4c
-
SHA1
3bc7799e2ffb7588742633359b8cf35209bb4e76
-
SHA256
94336ccbc2bf47d3d53813a6a84ba5eba80f8f5d10cb145d8cf99e50e737a471
-
SHA512
452afb91a5177915721d117637d7da530b16e8ce94849f9e249af88cf671596b565eb1c1971af5f9ae5f78a3e936c469a87f5e9dd146506f91551365dfa614da
-
SSDEEP
1572864:vvxZQglwWLvZSk8IpG7V+VPhqclE7hlgkiYgj+h58sMw091b4cJzU:vvxZxqGZSkB05awcYeu5Y91bU
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2540 sign crushes motorist.exe -
resource yara_rule behavioral1/files/0x0003000000020a00-1260.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2540 2708 sign crushes motorist.exe 30 PID 2708 wrote to memory of 2540 2708 sign crushes motorist.exe 30 PID 2708 wrote to memory of 2540 2708 sign crushes motorist.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\sign crushes motorist.exe"C:\Users\Admin\AppData\Local\Temp\sign crushes motorist.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\sign crushes motorist.exe"C:\Users\Admin\AppData\Local\Temp\sign crushes motorist.exe"2⤵
- Loads dropped DLL
PID:2540
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5546cc5fe76abc35fdbf92f682124e23d
SHA15c1030752d32aa067b49125194befee7b3ee985a
SHA25643bff2416ddd123dfb15d23dc3e99585646e8df95633333c56d85545029d1e76
SHA512cb75334f2f36812f3a5efd500b2ad97c21033a7a7054220e58550e95c3408db122997fee70a319aef8db6189781a9f2c00a9c19713a89356038b87b036456720