Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe
Resource
win10v2004-20240802-en
General
-
Target
20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe
-
Size
162KB
-
MD5
9c2e5a5513118ae4d49457462748f12a
-
SHA1
94677c7e333db8ee4460b5c1c64526c9eaaf7aa0
-
SHA256
20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000
-
SHA512
6b90ba8dd696f1cd2aecd0ff429efa947f9e95071b4a5cfa0fec0aaeb7d8e04245201a76f704551bf20992b14595ee5b7992750cc5e99c47119454f2d1cc6c39
-
SSDEEP
3072:WPBbSvucpYRrR5d+mYl/IZX0HjuRH/9xJCZcOW4I//4i:8b2E150szH/9xwcN4I34i
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2692 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe -
Executes dropped EXE 1 IoCs
pid Process 2692 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe -
Loads dropped DLL 1 IoCs
pid Process 2144 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2144 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2144 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe 2692 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2692 2144 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe 31 PID 2144 wrote to memory of 2692 2144 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe 31 PID 2144 wrote to memory of 2692 2144 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe 31 PID 2144 wrote to memory of 2692 2144 20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe"C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exeC:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe
Filesize162KB
MD50ca9c76ce87b5d1a8ba5cee506147c32
SHA1e721a446e3719af23b4b4e851d31e9b934120241
SHA25602484f81af88e3dce2f72e55a500260bb6c23e69b4a91cb424bfbbab4c215af3
SHA5127310d57ea37a37cfe20d8645a2119463cd8a72c679c41561da4c003381e5d305f67f7dfffae4a4a97233bef568ab08ad6ef4332827fcc7cdb76541935c191a8b