Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
01/08/2022, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
PO 7500093232.exe
Resource
win7-20220718-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
PO 7500093232.exe
Resource
win10v2004-20220721-en
15 signatures
150 seconds
General
-
Target
PO 7500093232.exe
-
Size
482KB
-
MD5
832efb6bf9f508ebb2c41257fadcc300
-
SHA1
1e8667e1561c3411f42f98c494dcc99be36d6d6a
-
SHA256
f9bc0d5860d6135dab48b897e55465d88ebd0ca9b73ebdbaf83957d6e3bee26f
-
SHA512
f866c97b78b006891b34b5afa8f0d3e3a8bf0e7033ab8970e142427e2611f07127fb3661bec26d43e0f68aa9e19aa8932adc2fb296cf1cdfdd85dd2b72eb30ea
Score
10/10
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Downloads MZ/PE file
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aLFDxEdS.lnk PO 7500093232.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1744 set thread context of 1052 1744 PO 7500093232.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1744 PO 7500093232.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27 PID 1744 wrote to memory of 1052 1744 PO 7500093232.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"C:\Users\Admin\AppData\Local\Temp\PO 7500093232.exe"2⤵PID:1052
-