Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/01/2025, 00:08
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
source_prepared.exe
Resource
win10v2004-20241007-en
General
-
Target
source_prepared.exe
-
Size
148.1MB
-
MD5
778c8f42e06a049d2dafa46798e4674e
-
SHA1
d11265afb0d5795b15e380c7f5c7e3b152654b9b
-
SHA256
e1802da5e44a875076df669d76c22835147d66deca4423178ee2736301e0fc99
-
SHA512
6f74a55fb7578ffa7e266a719ff32dc1636cc470cdb1b5e957be6947cfab87ec959fa444355f73b795e2b99d4d2e2f4c6a2eafe5786ba7809a447dfafc2eeb83
-
SSDEEP
3145728:dcgYRPSC++6y9aaAVt/VG6RmtCRlGPrLWf/+2qHO5ipgPpgvp/fgYV:6xaC4y9aZl5mERlu2+HCi7
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2952 source_prepared.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2952 1120 source_prepared.exe 29 PID 1120 wrote to memory of 2952 1120 source_prepared.exe 29 PID 1120 wrote to memory of 2952 1120 source_prepared.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"C:\Users\Admin\AppData\Local\Temp\source_prepared.exe"2⤵
- Loads dropped DLL
PID:2952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5f9a43765b486c561bf0895eb9390ed1f
SHA1b398fbd02bd7fdb32dcb88f11758a0a9826b75a4
SHA2563b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
SHA512f2709ba81fe1e01789fc0aae65d31f5adcfd64dd72d161b4cddfa35f91eb2c8d66954925c825b22ce9034fd894ee18500b1ff0a32e4d585491e09d2c540a305c
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1