Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 00:32
Behavioral task
behavioral1
Sample
XboxConnect.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
XboxConnect.exe
Resource
win10v2004-20241007-en
General
-
Target
XboxConnect.exe
-
Size
7.6MB
-
MD5
7a516a267a73b6e5fa91c0d27f4416fe
-
SHA1
739494a356b5917c9f0de1b73e0f7f87682add97
-
SHA256
6ffd9e96733943c41ded05d5b5795770f3304c84e75f96b76fc3584d8c43af60
-
SHA512
0bbbb283409747823fae2027f9805723ff03ab3ac4e4c958c0154b107e478fa97dac0770b77d8c911cf28624b0c5474ffdfc1f6f9d1a71c972e98468a42eee8b
-
SSDEEP
196608:RUD+kd+wfI9jUCBB7m+mKOY7rXrZusooDmhfvsbnTNWZ:O5DIHL7HmBYXrYoaUNm
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2520 XboxConnect.exe -
resource yara_rule behavioral1/files/0x000500000001a075-21.dat upx behavioral1/memory/2520-23-0x000007FEF5430000-0x000007FEF5A95000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2520 2264 XboxConnect.exe 30 PID 2264 wrote to memory of 2520 2264 XboxConnect.exe 30 PID 2264 wrote to memory of 2520 2264 XboxConnect.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD59a3d3ae5745a79d276b05a85aea02549
SHA1a5e60cac2ca606df4f7646d052a9c0ea813e7636
SHA25609693bab682495b01de8a24c435ca5900e11d2d0f4f0807dae278b3a94770889
SHA51246840b820ee3c0fa511596124eb364da993ec7ae1670843a15afd40ac63f2c61846434be84d191bd53f7f5f4e17fad549795822bb2b9c792ac22a1c26e5adf69