Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 09:43
Static task
static1
Behavioral task
behavioral1
Sample
0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe
Resource
win10v2004-20220901-en
General
-
Target
0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe
-
Size
87KB
-
MD5
07fb8a3df96c3f3a15c34c642621fff3
-
SHA1
55a899718cbb4a8940812da79066184e85c2873c
-
SHA256
0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78
-
SHA512
0e3f62a3df0361b06733cb62a400900354a327bf6b0a526d96a27620daf9d61ff8a525262475840398faaa38eb46a55c75debbf39dd6cf266dcd6ac3c28d8bb6
-
SSDEEP
1536:D76iwKMDFwHmWd/+4vW2/dCXLk0YTtQkWn9Wf1i22mlLI+YLVWFOV9bv:DzEwHmqW4vW2/+I0vH9citmlLCLcuxv
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yje2jo1o.exe 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yje2jo1o.exe 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2020 set thread context of 604 2020 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 26 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 604 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2020 wrote to memory of 604 2020 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 26 PID 2020 wrote to memory of 604 2020 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 26 PID 2020 wrote to memory of 604 2020 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 26 PID 2020 wrote to memory of 604 2020 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 26 PID 2020 wrote to memory of 604 2020 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 26 PID 2020 wrote to memory of 604 2020 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 26 PID 604 wrote to memory of 1412 604 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 12 PID 604 wrote to memory of 1412 604 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 12 PID 604 wrote to memory of 1412 604 0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe 12
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe"C:\Users\Admin\AppData\Local\Temp\0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe"C:\Users\Admin\AppData\Local\Temp\0e66cd7d0afc68d4727d571d7960c86a242ff8fc466fcc9fbac604fd5c4e1f78.exe"3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:604
-
-