Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
99s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23/11/2024, 18:35
Behavioral task
behavioral1
Sample
cmd.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
cmd.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
cmd.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
cmd.exe
Resource
win11-20241007-en
General
-
Target
cmd.exe
-
Size
6.0MB
-
MD5
b2fe874c2e11c56edf05c5250a8c966f
-
SHA1
06d6e28c3cb46e06195a5f8c360d8eeaddfb1c06
-
SHA256
255113355555cad23594618b606e851b38bcf588d902ec2678bb893582a90a4f
-
SHA512
915ec47beaf9a572c135fe0ddcccf2bb18b6620dcaf9fc8069436e4fe8d3dce15424c3043b45668c7c4f81e513bb731d7bd310eacea6ea1e01cb019b1cc71b90
-
SSDEEP
98304:skEtdFBCm/I5NamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RxOnAKuP/ty/:szFIm/PeN/FJMIDJf0gsAGK4R0nAKuXq
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2936 cmd.exe -
resource yara_rule behavioral1/files/0x00050000000195af-21.dat upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2936 cmd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2936 1740 cmd.exe 30 PID 1740 wrote to memory of 2936 1740 cmd.exe 30 PID 1740 wrote to memory of 2936 1740 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\cmd.exe"C:\Users\Admin\AppData\Local\Temp\cmd.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2936
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee