Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 17:53
Behavioral task
behavioral1
Sample
Exela.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Exela.exe
Resource
win10v2004-20241007-en
General
-
Target
Exela.exe
-
Size
10.9MB
-
MD5
2da0831e1fd1997a74a7d3f2ae175a7a
-
SHA1
bf53d53b5f16af0a6356784d92db0e9ca4b13c64
-
SHA256
ae531b990861b3d4ac3568d59ff0eaac75db6a050e3dd0af5f6ef7c3fd1f10e8
-
SHA512
032b7a2b6b0f079f8b9f9a6ec82e9cca5ce8e24e639bff040246c44c47ddc4525600617c20dbc98c7e1950b3eb545d8f41c7b3e5586cc0ec2dbc93d298196543
-
SSDEEP
196608:MM/IwHKAme2/TLx4hz7DIxyueNK+wfm/pf+xfdkRLWKqrIWOY/WKDa9kH:DLmeATGz7kQK+9/pWFGRLBqrIW97aiH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 684 Exela.exe -
resource yara_rule behavioral1/files/0x000500000001a49e-46.dat upx behavioral1/memory/684-48-0x000007FEF66E0000-0x000007FEF6CC8000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2332 wrote to memory of 684 2332 Exela.exe 30 PID 2332 wrote to memory of 684 2332 Exela.exe 30 PID 2332 wrote to memory of 684 2332 Exela.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45