Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
83s -
max time network
90s -
platform
windows7_x64 -
resource
win7 -
submitted
09/07/2020, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe
-
Size
152KB
-
MD5
e811834b43a7c3eb14b25551d27bf5bb
-
SHA1
c63c4cfe5aee3757f24a205e04b45f8357d28e4a
-
SHA256
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4
-
SHA512
3edd82c715e892a07b3dffc022ff42e71b84947ae45abdf858208c7326a8703ba13ca03108d9b60af0f82362cef913e3899dc48823d36f7f605e49d123c3a846
Score
8/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1088 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1312 1088 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe 25 PID 1088 wrote to memory of 1312 1088 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe 25 PID 1088 wrote to memory of 1312 1088 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe 25 PID 1088 wrote to memory of 1312 1088 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe 25 -
Executes dropped EXE 1 IoCs
pid Process 1312 bdif.exe -
NTFS ADS 1 IoCs
description ioc Process File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe"C:\Users\Admin\AppData\Local\Temp\85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:1088 -
\??\c:\programdata\e6533cd889\bdif.exec:\programdata\e6533cd889\bdif.exe2⤵
- Executes dropped EXE
PID:1312
-