Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe
Resource
win10v2004-20221111-en
General
-
Target
f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe
-
Size
1.3MB
-
MD5
1c6ba3cfae997feed569bc1568d3c693
-
SHA1
4c355dea712d6803878683e14f73078e84e5dd09
-
SHA256
f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454
-
SHA512
2b24590ec2a66b00c9ce9f63697f35768ac413dee23b8a1202781c81f03f8ca7069a67ca809e36883847528e85f5612541c7be8030a2cb2c0e8be3a826a4e1d6
-
SSDEEP
24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakl:TrKo4ZwCOnYjVmJPai
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1492 set thread context of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1124 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 1124 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 1124 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 1124 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 1124 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27 PID 1492 wrote to memory of 1124 1492 f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe"C:\Users\Admin\AppData\Local\Temp\f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\f912dc72be21aed8e1b5ac6b1db2bf2f86f07af864051a14a16490a7f7f7b454.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1124
-