Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01/02/2025, 03:42
Behavioral task
behavioral1
Sample
Islands Dupe V3 External.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Islands Dupe V3 External.exe
Resource
win10v2004-20250129-en
General
-
Target
Islands Dupe V3 External.exe
-
Size
6.1MB
-
MD5
d9bd5db0ec0702a42b99289fc9c14257
-
SHA1
2ba264894d2f92f5a8c13138d3e14b6f16c02a10
-
SHA256
3533705363fd53ca105a1ffbc14785471e20165ea9db8d5819fa271047eaadb6
-
SHA512
6dbf10a35eed15e71c32bfc5bb5ec07aef21aeea2ddea15bd528ccfce172669ed3f8724362b69c3825532ad02d59b4b747d4c72f9619aec94cb57dd3310910bd
-
SSDEEP
196608:alwWFjudeN/FJMIDJf0gsAGK4RdkY9E+al:RG/Fqyf0gstdkOB2
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2500 Islands Dupe V3 External.exe -
resource yara_rule behavioral1/files/0x0006000000016d67-21.dat upx behavioral1/memory/2500-23-0x000007FEF5B60000-0x000007FEF5FCE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3036 wrote to memory of 2500 3036 Islands Dupe V3 External.exe 30 PID 3036 wrote to memory of 2500 3036 Islands Dupe V3 External.exe 30 PID 3036 wrote to memory of 2500 3036 Islands Dupe V3 External.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Islands Dupe V3 External.exe"C:\Users\Admin\AppData\Local\Temp\Islands Dupe V3 External.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\Islands Dupe V3 External.exe"C:\Users\Admin\AppData\Local\Temp\Islands Dupe V3 External.exe"2⤵
- Loads dropped DLL
PID:2500
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee