Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 14:01
Behavioral task
behavioral1
Sample
Built.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Built.exe
Resource
win10v2004-20241007-en
General
-
Target
Built.exe
-
Size
6.9MB
-
MD5
0b3c4412a39a1b6f2a5dabe5798c4a7e
-
SHA1
3c3caab6dcf94f52bd03ff1e5bb22d32e856944d
-
SHA256
5218a0496b2ac9e6ad759a7884fce55c948f89c97c0f3313b14c4db7a3015dd0
-
SHA512
bca692d7a2d60c0f8d53ce2959e0a47e008cb543b6ba298b92ea02315faa75ae9639ba6f69520b38ab8ba6c4666abbbbe2eeab270a93b06c2a386b94ce8b3729
-
SSDEEP
98304:ENDjWM8JEE1FJTi9amaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEY:EN0zJeNTfm/pf+xk4dWRpmrbW3jmrp
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1564 Built.exe -
resource yara_rule behavioral1/files/0x0005000000019582-21.dat upx behavioral1/memory/1564-23-0x000007FEF57E0000-0x000007FEF5DC8000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1564 2600 Built.exe 30 PID 2600 wrote to memory of 1564 2600 Built.exe 30 PID 2600 wrote to memory of 1564 2600 Built.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31