Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/10/2022, 19:09
Behavioral task
behavioral1
Sample
4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe
Resource
win10v2004-20220901-en
General
-
Target
4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe
-
Size
880KB
-
MD5
573e5af44459e96fc9c9b026992416f8
-
SHA1
953a65a84e9a5431aea063533fee855d74a70928
-
SHA256
4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55
-
SHA512
21767d60d780f860717a09d3454ff275a2c4e4738bc59a9cfd2fbf2fe0da67fa5af6867d96475ffe13eb5a42b1d90f059b421a5f979192873c34cc398de9b4a6
-
SSDEEP
12288:wuXz+6yYrqyTh+jOsxgRISEs4inBld78IGnSQyiFIKcO4v3f+5x5zqqQKlcqwIM2:v+6rhqNutBldRGSN1X+53znCBj
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2000 316 WerFault.exe 13 -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.MyNSHandler 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.MyNSHandler\ = "this is my ebook" 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.MyNSHandler\Clsid\ = "{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}" 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ = "this is my ebook" 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe" 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.MyNSHandler\Clsid 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\ProgID\ = "4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.MyNSHandler" 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC} 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8CFC029-8420-4EAE-ADEF-915BDC77E1DC}\LocalServer32 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 316 wrote to memory of 2000 316 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe 27 PID 316 wrote to memory of 2000 316 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe 27 PID 316 wrote to memory of 2000 316 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe 27 PID 316 wrote to memory of 2000 316 4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe"C:\Users\Admin\AppData\Local\Temp\4b360024d24204b2ac122fde6b6b6990d9e338d7ad595b05daaf2417cb351c55.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 4002⤵
- Program crash
PID:2000
-