Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 10:22
Behavioral task
behavioral1
Sample
666Executor.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
666Executor.exe
Resource
win10v2004-20241007-en
General
-
Target
666Executor.exe
-
Size
17.9MB
-
MD5
4306bc056d7a49c6fe7db3226ba445d7
-
SHA1
46d16380247beb8d568e39b12acb3315858c8519
-
SHA256
d6808dd1bea15672872c5228a9b2b4b2636f83f1e3fdb9448a42904ed5278440
-
SHA512
c590695d5cdafa2e149cf984950ba5f52dbe97088f29cdec06b51aa7dc891de8e4396bd27d20a4ad932701e18c567276131d66d04968d3e5a074734a8ce9b9d1
-
SSDEEP
393216:NqPnLFXlr/QMDOETgsvfGiJgOQaDvE6cbqJ0tq:UPLFXN/QREtHCdqJ
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1416 666Executor.exe -
resource yara_rule behavioral1/files/0x0005000000019627-112.dat upx behavioral1/memory/1416-114-0x000007FEF68E0000-0x000007FEF6D4E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1344 wrote to memory of 1416 1344 666Executor.exe 28 PID 1344 wrote to memory of 1416 1344 666Executor.exe 28 PID 1344 wrote to memory of 1416 1344 666Executor.exe 28
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378