Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 01:54
Behavioral task
behavioral1
Sample
RoFix.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RoFix.exe
Resource
win10v2004-20241007-en
General
-
Target
RoFix.exe
-
Size
35.5MB
-
MD5
c685da925e0d4cd81253fc2a862bcacd
-
SHA1
524fb7ceb23455fba9a1178227df36c63649cd17
-
SHA256
f33f4b5d2ec9e421f0d5b2b9f70b2caef04f24f3188e5198933cbbd3c487daa6
-
SHA512
5cd7381fb350037ed0b2fddd6dfc90dfcbb6129fc9ca38435301ecf886b240b61b4f75f48e5f7821c111ce698052eff937a24ec40dd34764a7f68d91e70919ff
-
SSDEEP
786432:T6VjlxwW8bKLXm1NwO8zcY876MlXRXuBBjWx8vWnWGmVtRJ8rn2k:eVjlCWK2XmwlE71lh+BBy7njQtzMn
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2452 RoFix.exe -
resource yara_rule behavioral1/files/0x0003000000020aed-1163.dat upx behavioral1/memory/2452-1165-0x000007FEF6070000-0x000007FEF6735000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 628 wrote to memory of 2452 628 RoFix.exe 31 PID 628 wrote to memory of 2452 628 RoFix.exe 31 PID 628 wrote to memory of 2452 628 RoFix.exe 31
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD56f7c42579f6c2b45fe866747127aef09
SHA1b9487372fe3ed61022e52cc8dbd37e6640e87723
SHA25607642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5
SHA512aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec