Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/01/2025, 13:30
Behavioral task
behavioral1
Sample
vanish.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
vanish.exe
Resource
win10v2004-20241007-en
General
-
Target
vanish.exe
-
Size
7.5MB
-
MD5
a1006e5babbb7e99e3041986c7aab9fd
-
SHA1
c4df6551e48b11114b05396f7a36fee3bf26b466
-
SHA256
ebf548e65b8f05f66462e7247444fc75b6759033a873919c1f973d650ed549cf
-
SHA512
8f45173a16e88e7924eff0808a9f48df6cf81a1117b8499f743727eb75f99e440d3d174472295aaee8b9d28bb91611c43faf96c4991ede9f9ca619f538b2e281
-
SSDEEP
196608:99gFkwfI9jUC2gYBYv3vbWY+iITm1U6fd1EZ:UFbIH2gYBgDW/TOzb+
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2824 vanish.exe -
resource yara_rule behavioral1/files/0x00050000000191f3-21.dat upx behavioral1/memory/2824-23-0x000007FEF6940000-0x000007FEF7005000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2824 2736 vanish.exe 31 PID 2736 wrote to memory of 2824 2736 vanish.exe 31 PID 2736 wrote to memory of 2824 2736 vanish.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\vanish.exe"C:\Users\Admin\AppData\Local\Temp\vanish.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\vanish.exe"C:\Users\Admin\AppData\Local\Temp\vanish.exe"2⤵
- Loads dropped DLL
PID:2824
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2576
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD56f7c42579f6c2b45fe866747127aef09
SHA1b9487372fe3ed61022e52cc8dbd37e6640e87723
SHA25607642b6a3d99ce88cff790087ac4e2ba0b2da1100cf1897f36e096427b580ee5
SHA512aadf06fd6b4e14f600b0a614001b8c31e42d71801adec7c9c177dcbb4956e27617fa45ba477260a7e06d2ca4979ed5acc60311258427ee085e8025b61452acec