Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
89s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe
Resource
win10v2004-20220812-en
General
-
Target
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe
-
Size
157KB
-
MD5
7d1ed080cf48dc127655f0edc91450e1
-
SHA1
67735ea2edc526b053a0055b59bc46224f4cf2e1
-
SHA256
c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84
-
SHA512
10aa22227c78eb854937a1486857ebe6930f9377c5d15456dff611dd1c8be1a9e784928918b6897ef0a911e6dccae70cc149964f7cfb8d11310046ec49bf0c8c
-
SSDEEP
3072:ladYAFNbRRNliiJ8kGTkQv/pOmo4FyqwgCyKY8Xb8Y+o/:l9A3trliiieIRO5mVYn
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1508 cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 848 PING.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1772 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 1772 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1772 wrote to memory of 1508 1772 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 31 PID 1772 wrote to memory of 1508 1772 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 31 PID 1772 wrote to memory of 1508 1772 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 31 PID 1772 wrote to memory of 1508 1772 c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe 31 PID 1508 wrote to memory of 848 1508 cmd.exe 33 PID 1508 wrote to memory of 848 1508 cmd.exe 33 PID 1508 wrote to memory of 848 1508 cmd.exe 33 PID 1508 wrote to memory of 848 1508 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe"C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.execmd.exe /e:on /d /c ping -n 6 127.0.0.1 && DEL /F "C:\Users\Admin\AppData\Local\Temp\c10a3e7e534e6f1c244012257e95bbd8c07ed0f97a0c3fbb86313c73d7f1ce84.exe" >> nul2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\PING.EXEping -n 6 127.0.0.13⤵
- Runs ping.exe
PID:848
-
-