Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/01/2025, 23:14
Behavioral task
behavioral1
Sample
smaaaxzcolorbot.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
smaaaxzcolorbot.exe
Resource
win10v2004-20241007-en
General
-
Target
smaaaxzcolorbot.exe
-
Size
7.7MB
-
MD5
98c5e538f4a9c40e3a1450cbb8136c95
-
SHA1
55824469ccba8ab3eafe84e7b516b197a1d3699b
-
SHA256
ba3afd717d843bf0946c20b1763e298d4467bfff8cbad4f8ad1fb6ae8fd06d41
-
SHA512
558f40e83a1c16fd43790e78d434dfa298a710fe7c25bcf79efc1025c95c1b27372770c82a5fe011dab9370fa03fd69067d82be1c95535d511310a900b5ceb40
-
SSDEEP
196608:wKD+kdFwfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWE:b5AIHL7HmBYXrYoaUNf
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2556 smaaaxzcolorbot.exe -
resource yara_rule behavioral1/files/0x000500000001878f-21.dat upx behavioral1/memory/2556-23-0x000007FEF6370000-0x000007FEF69D5000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2556 2764 smaaaxzcolorbot.exe 30 PID 2764 wrote to memory of 2556 2764 smaaaxzcolorbot.exe 30 PID 2764 wrote to memory of 2556 2764 smaaaxzcolorbot.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\smaaaxzcolorbot.exe"C:\Users\Admin\AppData\Local\Temp\smaaaxzcolorbot.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\smaaaxzcolorbot.exe"C:\Users\Admin\AppData\Local\Temp\smaaaxzcolorbot.exe"2⤵
- Loads dropped DLL
PID:2556
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59a3d3ae5745a79d276b05a85aea02549
SHA1a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA25609693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
SHA51246840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69