Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
31/01/2025, 05:24
Behavioral task
behavioral1
Sample
IslandDupeAppwithexecutor.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
IslandDupeAppwithexecutor.exe
Resource
win10v2004-20250129-en
General
-
Target
IslandDupeAppwithexecutor.exe
-
Size
6.0MB
-
MD5
92c78207eb95da0b3202d144be1bd51c
-
SHA1
4bd9478d59a886ed031da8b483445ef386873109
-
SHA256
3d3ee61c8ac3b08ae5fa3bd9df4fa703c99f782f524cbb4fd602d5496069a8d9
-
SHA512
13329568971cc3e1d5251900a753e1a44f08709dcde68e4e9210e7268f9503a431bf4e5f9feee0d655e382d9a968417703449a5e3e5f8446c8eea2c9df5da0aa
-
SSDEEP
98304:/uEtdFBgwsvamaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4R8PM2yb3cMIKY5:/tFmyeN/FJMIDJf0gsAGK4R8k2oIKY5
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2660 IslandDupeAppwithexecutor.exe -
resource yara_rule behavioral1/files/0x0005000000019269-21.dat upx behavioral1/memory/2660-23-0x000007FEF60F0000-0x000007FEF655E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2660 2416 IslandDupeAppwithexecutor.exe 31 PID 2416 wrote to memory of 2660 2416 IslandDupeAppwithexecutor.exe 31 PID 2416 wrote to memory of 2660 2416 IslandDupeAppwithexecutor.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\IslandDupeAppwithexecutor.exe"C:\Users\Admin\AppData\Local\Temp\IslandDupeAppwithexecutor.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\IslandDupeAppwithexecutor.exe"C:\Users\Admin\AppData\Local\Temp\IslandDupeAppwithexecutor.exe"2⤵
- Loads dropped DLL
PID:2660
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee