Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
22/11/2022, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe
Resource
win10v2004-20221111-en
General
-
Target
ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe
-
Size
1.3MB
-
MD5
1fcc6cfe015dde8ded74bf86619e4de7
-
SHA1
c3ee8fa8081da1be08c6bdcd950abdcbc220cc13
-
SHA256
ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af
-
SHA512
1450bd12c4336ac2025ce8df0a6aeed5b84e1d67b8d08ed70589ae95c9101f0284f3c4275907e900e58b0aeb1e4426f0c1152388c3fbd5488f339a49e441a15d
-
SSDEEP
24576:zrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPak1:zrKo4ZwCOnYjVmJPaC
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2024 set thread context of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1744 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 1744 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 1744 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 1744 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 1744 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28 PID 2024 wrote to memory of 1744 2024 ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe"C:\Users\Admin\AppData\Local\Temp\ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\ba795a3c91cd9b65c06a6a2c4c622b63932a001b6bd499aa901718ee9e7323af.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1744
-