Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
175s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
19/09/2022, 22:29
Static task
static1
Behavioral task
behavioral1
Sample
e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe
Resource
win10-20220812-en
General
-
Target
e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe
-
Size
2.0MB
-
MD5
4b2f52a5a9d6f4fbe5839cdeba0780fb
-
SHA1
eae2e0e28d503d2add491d00105e5ea72606aeb8
-
SHA256
e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6
-
SHA512
384490a7c9dcaf3139f5cc9e253eb914dec1a1c15b860ad53322082118a36727bfb9f267fb6709410f93b8c113ec52c4ad287882b1abef5b720e1952eeced28c
-
SSDEEP
49152:eBKnLQEGjYIDTI2ePP4Qudz7XxlhcJj9NX9qCWpCS:eBvjYIPI2evudhlGJo9pN
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2824 2208 WerFault.exe 65 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4704 schtasks.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2208 wrote to memory of 4704 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe 66 PID 2208 wrote to memory of 4704 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe 66 PID 2208 wrote to memory of 4704 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe 66 PID 2208 wrote to memory of 4192 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe 68 PID 2208 wrote to memory of 4192 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe 68 PID 2208 wrote to memory of 4192 2208 e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe"C:\Users\Admin\AppData\Local\Temp\e0b7c23920e0dbb946862fbbbdd55bf2fd400e654c352d7e5d46b250fbfc20d6.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "Event Viewer Snap-in Launcher (29762912)" /tr "C:\Users\Admin\AppData\Roaming\EventViewer\eventvwr.exe"2⤵
- Creates scheduled task(s)
PID:4704
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "Event Viewer Snap-in Launcher (29762912)"2⤵PID:4192
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 6922⤵
- Program crash
PID:2824
-