Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08/05/2022, 05:30
Behavioral task
behavioral1
Sample
1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe
-
Size
711KB
-
MD5
0002d90525a914df059de1b20b05f003
-
SHA1
058991c410a1c2431195025d53dfe98200c44938
-
SHA256
1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00
-
SHA512
d1d4e61bee1d3be9fa35af8406c37c6707819d1392c4c3f08099aa07679e8292a62840f93a7491e5e526c598ecba7ebe73d7bb5c67ac1827bfc3993c89b508d7
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CSRLT.EXE = "C:\\Windows\\system32\\CSRLT.EXE" 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\MSBLT.EXE = "C:\\Windows\\MSBLT.EXE" 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\CSRLT.EXE 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe File opened for modification C:\Windows\SysWOW64\CSRLT.EXE 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\MSBLT.EXE 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe File opened for modification C:\Windows\MSBLT.EXE 1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe"C:\Users\Admin\AppData\Local\Temp\1753e113812f9b0000c6874c7a7225217fa9a40f25e0b0a0309e3e46ed0e5e00.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
PID:872