Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 01:29
Static task
static1
Behavioral task
behavioral1
Sample
28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe
Resource
win10v2004-20220812-en
General
-
Target
28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe
-
Size
277KB
-
MD5
077520258d8c32ec6b06e7aeb77f02d0
-
SHA1
a47cc6b48b5ec7b181956f35a54418b5dd3d78e2
-
SHA256
28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655
-
SHA512
9e2c88eae77e2d2dac3f898ee02fcceab54cbb2cd05efd828f280352df9f030ffad0c22871e107933f511601c16693b195979b6e81e6c5cf698578c0c5bb6836
-
SSDEEP
3072:A6/9xTLsKrcwK9DnKY9lSBrvEAjEjcchZW+fTcfO5w8KcpAHpqXuNVBbd7mxv/1:J9xTTvES5v4alfl80qXfxn1
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\14869 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccyikizj.pif" svchost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccyikizj.pif svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1980 28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe 1980 28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1980 wrote to memory of 1756 1980 28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe 28 PID 1980 wrote to memory of 1756 1980 28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe 28 PID 1980 wrote to memory of 1756 1980 28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe 28 PID 1980 wrote to memory of 1756 1980 28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe"C:\Users\Admin\AppData\Local\Temp\28ee8f39d1ffc6ffb24fac749febea70052bcedad509df05ab2c44e43577d655.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe2⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
PID:1756
-