Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 15:11
Behavioral task
behavioral1
Sample
54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe
Resource
win10v2004-20220812-en
General
-
Target
54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe
-
Size
58KB
-
MD5
1e5b40b81eb0caa33e21cc126dea794d
-
SHA1
1232c9ba796a716235b06958bfc9016260a01239
-
SHA256
54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563
-
SHA512
b27df49f619d147be202b762ab3267819aa2d75d702216b3ea88f5b00be1bb7e1adf725a4697ba2b9125f650f884278947e7e27cfac35f0a6e4292547d3ec974
-
SSDEEP
1536:rnHVpNXZgzKQe9Tie7sZwHRz5PgknOJE4U3mJsWKNpSpH:bHTMCwe7Qwxz9gskE4UWJuSpH
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1272-56-0x0000000000E50000-0x0000000000E70000-memory.dmp upx -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: 54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe File opened (read-only) \??\K: 54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1316 1272 WerFault.exe 26 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1316 1272 54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe 27 PID 1272 wrote to memory of 1316 1272 54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe 27 PID 1272 wrote to memory of 1316 1272 54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe 27 PID 1272 wrote to memory of 1316 1272 54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe"C:\Users\Admin\AppData\Local\Temp\54907c58a3f61b2620d9c2528314fe2dd60f4030bc97869ba06f351995730563.exe"1⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 962⤵
- Program crash
PID:1316
-