Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
23/01/2025, 18:01
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20241007-en
General
-
Target
source_prepared.exe
-
Size
83.9MB
-
MD5
a9d8311bca7256c62b23e24e005cb8a0
-
SHA1
850049dac3f3b0fa5f81df63a6bcb1fe084feee5
-
SHA256
0628aa27f41f64a27a711349cdf6c50815539757aed273be29e31a0b7e0efc5d
-
SHA512
22199e8b3388f31e4d9e069b1b4ff05d6cd8d3e6cf896c7de23d9cd4d387b1266980ee2c195696966326427ec4de2d688972421f3e07527309ccbab15c686ae7
-
SSDEEP
1572864:HVjl4WI2Fm7OkiqOv8im2A3+TUE7slh+eiYweyJulZUdgKXQAU2/S0sk2Hy:9++Fm7OknOv8i36+TCLkpumXFUKsk2y
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
pid Process 1624 source_prepared.exe 1624 source_prepared.exe 1624 source_prepared.exe 1624 source_prepared.exe 1624 source_prepared.exe 1624 source_prepared.exe 1624 source_prepared.exe -
resource yara_rule behavioral1/files/0x0003000000020aa3-1321.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1624 2016 source_prepared.exe 30 PID 2016 wrote to memory of 1624 2016 source_prepared.exe 30 PID 2016 wrote to memory of 1624 2016 source_prepared.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:1624
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5a855f5ffc6690c1bd1706d1dae6251a2
SHA1075f84148285a2b61808d3094c8e1fe35466d59f
SHA25698b4b6a29374e68a383bd6e4b58cd76223335d38d2586c5a494466444811b75c
SHA51235ee703d27e15e192a847f86c22ad613880e1e53296a1bc0ae2249b2a777a0bfe3695fd609278281e8b3e5621534a242c3d3a7bda48c7ab23e513b59ceeb889d
-
Filesize
21KB
MD518a078bf6941f50fc3158b749441b9ce
SHA1279e944990b2fb184a6d09e3e62f574751e2e9a7
SHA256637e9a34044c366b9b004e62ee15aa4875e344a5a6b7634c803a40d95883d7cc
SHA512bc45590aaa25264e2c9640f5a9a357d6b0cf88e9027fcf70fcad666a50cc309378ce9a49e0d02cdf299b2631b724e863e31061090d6ae7893db048afa6fb6943
-
Filesize
21KB
MD58a52d5f941f257c581e856811586b887
SHA1a510353c67126ec00d13a3f4c0b2e494394a2949
SHA2566ce59c2de64b6195695e8754636cbe283a7af3ddb78acf32c3879d7d09aba4b1
SHA51239bad27e61d9a694740556c8290739780ebd7cfdd1f909b85a37ef5c55bc3bd8f439cb6e26d77715649bb04ae701a02fc789535f0d23a5db9ca4a981a38fcb8e
-
Filesize
21KB
MD5cb6102cdcd530e82f9a7f2579dd5be22
SHA18f1881ba356c8d7497580fc5efe2681200632cae
SHA256f5c82a141bdc7929bb3d6d4196c0e8501f4a894fd65a435f8134c073134461ac
SHA512bc9129d58c05991f4567d2ce64e5d5a5ecaa876503ee0644ac61b67fea4b794251cd0f1d1631ef63e8f530a0db074684cde9f35d852ddcb50a9b02d641a63d59
-
Filesize
21KB
MD57f0a0a190aea88884088bd09d36a2c4b
SHA1f8d3039deda1f7fc025f4e4cbbc3010cba3762b3
SHA256a202f21169cc103c019019d3cbc05c3549a8dbac6eed0ecb4e5281e36f028a26
SHA5125f75ad8016ee9649cd565e27930f951cfc7b40b468ca7a5792578301ff2a16825ca2a98103ba8f4e6d8feb761655be1d8c24fa9e1d539bec6c3a5b3a04f8e9b6
-
Filesize
1.8MB
MD5cfa2e5cdda9039831f12174573b20c7b
SHA1c63a1ffd741a85e483fc01d6a2d0f7616b223291
SHA256b93e682bddb5c3e2af1f0264e83fbc40481fe6abd90c3ab26e94f246c8ce8d7d
SHA512f1ac568bd1a16d5ab2623ac42a83aed32d9867a0e016e0ac3c922f28ceb1bb7e114dab44553949008a6e2fd3bb67fc2be8fc283560d9f4b1f1552137a0c104aa
-
Filesize
1.1MB
MD505f2140c1a8a139f2e9866aa2c3166f1
SHA19170cff11f3b91f552ac09a186a3bae7ea7cda25
SHA256048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733
SHA512bdc7daf31fa9261967cab58c928fe5146b53c96f9b7c702ae8ee761b2652702d9f34dabf4252b7b580311d6dd4d2914ea7721296bebcea3344006eaa0f99f2ed