Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4294180s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
01/03/2022, 05:38
Behavioral task
behavioral1
Sample
5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe
Resource
win7-20220223-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe
-
Size
812KB
-
MD5
22bd08d77587e2e781bff43fee01ef60
-
SHA1
42443848b368e0b475b5658b231b52bbad9367cf
-
SHA256
5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92
-
SHA512
1710438b72fbb6ef522707ee853b1782bfd418a8693b63a2cfcf4a1032c730672a8d526d2d65b89f389220a47bd4b7af0066aff1332d027883aed0ba59d16535
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE" 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE" 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\CSRLT.EXE 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe File opened for modification C:\Windows\SysWOW64\CSRLT.EXE 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\MSBLT.EXE 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe File created C:\Windows\MSBLT.EXE 5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe"C:\Users\Admin\AppData\Local\Temp\5b7b354e02f7d75dbff4a51e21a26b03475208d1952b23dbaa2a0eaa779a9a92.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:788