Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25/11/2022, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe
Resource
win10v2004-20220812-en
General
-
Target
6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe
-
Size
931KB
-
MD5
4f21d509b2f4824f696ea3089ea1fd53
-
SHA1
a053a62d807cc85f6ec4a637a316f10b230ca797
-
SHA256
6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418
-
SHA512
3540c79b1f7a017b2819962c07f0c17fa72a6fb78bca89a4ff12868460345f4c79fc994e49edead391f3a6d1c96513b30253565a21b1fa90a347642e11f43bf1
-
SSDEEP
24576:i6IMwPvmB/wWq+5DUTt7FGSwmpu8nL6YKU:i6j19rut7FoU56G
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/672-55-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/672-57-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/672-58-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/672-62-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/672-63-0x0000000000400000-0x00000000004EA000-memory.dmp upx behavioral1/memory/672-64-0x0000000000400000-0x00000000004EA000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1492 set thread context of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 672 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28 PID 1492 wrote to memory of 672 1492 6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe"C:\Users\Admin\AppData\Local\Temp\6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe"C:\Users\Admin\AppData\Local\Temp\6670458edc45042d3c9d4d40895de16af8acb8bc8402ab92fd257b1c0416b418.exe" Track="0001001000"2⤵
- Suspicious use of SetWindowsHookEx
PID:672
-