Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/12/2024, 23:05
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Bootstrapper.exe
Resource
win10v2004-20241007-en
General
-
Target
Bootstrapper.exe
-
Size
81.0MB
-
MD5
8e4459028b7b17ef356a8be2ad50c8ed
-
SHA1
084c9494f68755bc64e0fceb97834af2ccfec5d6
-
SHA256
f1e72b5329dc4d9f7c459aea493d8c59bd0521d82129d168bf7d155924b768c6
-
SHA512
fc60a89d0516d38fa75bfbd45cc3edd483d8d879e20b7c885bbba1b839caa9e6aaa121b14b164e02dc4f3f189f58980eb0952b85f22c433237e42457a224d0ad
-
SSDEEP
1572864:AGKlEWvsmwSk8IpG7V+VPhqYdfmE7FliwiYgj+h58sMwGybhiDENjwJq:5KeysmwSkB05awcfNwy5SybGW
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1284 Bootstrapper.exe -
resource yara_rule behavioral1/files/0x0003000000020a53-1264.dat upx behavioral1/memory/1284-1266-0x000007FEF6180000-0x000007FEF6772000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2644 wrote to memory of 1284 2644 Bootstrapper.exe 30 PID 2644 wrote to memory of 1284 2644 Bootstrapper.exe 30 PID 2644 wrote to memory of 1284 2644 Bootstrapper.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"2⤵
- Loads dropped DLL
PID:1284
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5548809b87186356c7ac6421562015915
SHA18fa683eed7f916302c2eb1a548c12118bea414fa
SHA2566c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1
SHA512c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc