Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 22:34
Behavioral task
behavioral1
Sample
TURETspammer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
TURETspammer.exe
Resource
win10v2004-20241007-en
General
-
Target
TURETspammer.exe
-
Size
12.6MB
-
MD5
c922e48f78ca76caaae16fdbaa3bf5fa
-
SHA1
9405e8213d4fb292ba0e0563beaf395b3bfcd38e
-
SHA256
0039623c629d76c751f8b258fd19dafdc43822fc203d39c056110090d811af00
-
SHA512
47ac9de96555343ad259370db1e2568d5c77566026ee713429a4a23bee9b3b737812849f71dca56e5ed47d08d1a4c255bb2b25d87f14fc8bc77de1c857dce72b
-
SSDEEP
393216:XAWdqouwq3Obs2ClzbjdQJlSwF3MnG3xl580br2W673KH:XA8Luwq3ObRqzXdQn3MGxhW36
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2856 TURETspammer.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2856 2500 TURETspammer.exe 30 PID 2500 wrote to memory of 2856 2500 TURETspammer.exe 30 PID 2500 wrote to memory of 2856 2500 TURETspammer.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\TURETspammer.exe"C:\Users\Admin\AppData\Local\Temp\TURETspammer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\TURETspammer.exe"C:\Users\Admin\AppData\Local\Temp\TURETspammer.exe"2⤵
- Loads dropped DLL
PID:2856
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.5MB
MD59a24c8c35e4ac4b1597124c1dcbebe0f
SHA1f59782a4923a30118b97e01a7f8db69b92d8382a
SHA256a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
SHA5129d9336bf1f0d3bc9ce4a636a5f4e52c5f9487f51f00614fc4a34854a315ce7ea8be328153812dbd67c45c75001818fa63317eba15a6c9a024fa9f2cab163165b