Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe
Resource
win10v2004-20220812-en
General
-
Target
731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe
-
Size
128KB
-
MD5
6f7b0fbfb5a6aa1c54de5a83bbe40187
-
SHA1
ef7b460e9f27828197114cc9000ce30f7fff8574
-
SHA256
731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e
-
SHA512
a3ef4ce6bada6c2445d9678347b15f72a5fd2883f24c5dc1132b4569aee04d64605a5e1552eca59ed83585c048f7d8f19c7e68ce19a4abfc778674f537719a5a
-
SSDEEP
3072:sIeal2ZX8pP2Cn8Jcc64x6ohc7cZydst/hYb:Heal2ZAPtH47ABst/h
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\cache.dat" svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 620 731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe 472 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe 472 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 620 731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe 620 731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 472 svchost.exe 472 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 472 wrote to memory of 1072 472 svchost.exe 28 PID 472 wrote to memory of 1072 472 svchost.exe 28 PID 472 wrote to memory of 1072 472 svchost.exe 28 PID 472 wrote to memory of 1072 472 svchost.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe"C:\Users\Admin\AppData\Local\Temp\731797e3f20ebd1de7ac5ebf3d4360bce5cca9f3e6050e175f5fff40391eb18e.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:620
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe2⤵PID:1072
-