Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1100.exe
windows7-x64
8100.exe
windows10-2004-x64
10101.exe
windows7-x64
1101.exe
windows10-2004-x64
1102.exe
windows7-x64
8102.exe
windows10-2004-x64
5103.exe
windows7-x64
8103.exe
windows10-2004-x64
1105.exe
windows7-x64
10105.exe
windows10-2004-x64
10106.exe
windows7-x64
8106.exe
windows10-2004-x64
1107.exe
windows7-x64
6107.exe
windows10-2004-x64
6108.exe
windows7-x64
10108.exe
windows10-2004-x64
10109.exe
windows7-x64
10109.exe
windows10-2004-x64
5110.exe
windows7-x64
10110.exe
windows10-2004-x64
10111.exe
windows7-x64
10111.exe
windows10-2004-x64
10112.exe
windows7-x64
8112.exe
windows10-2004-x64
7113.exe
windows7-x64
10113.exe
windows10-2004-x64
10114.exe
windows7-x64
10114.exe
windows10-2004-x64
8115.exe
windows7-x64
10115.exe
windows10-2004-x64
10116.exe
windows7-x64
8116.exe
windows10-2004-x64
7Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 11:26
Static task
static1
Behavioral task
behavioral1
Sample
100.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
100.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
101.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
101.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
102.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
102.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
103.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
103.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
105.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
105.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
106.exe
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
106.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
107.exe
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
107.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
108.exe
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
108.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
109.exe
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
109.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral19
Sample
110.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
110.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral21
Sample
111.exe
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
111.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
112.exe
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
112.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
113.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
113.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
114.exe
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
114.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
115.exe
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
115.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
116.exe
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
116.exe
Resource
win10v2004-20221111-en
General
-
Target
109.exe
-
Size
1.5MB
-
MD5
48b5f870cd52e63adff35391961974b5
-
SHA1
b355a7ea90387606c41b9641c9c7857250335ed9
-
SHA256
7a84c0090ef3aa1210ff677298007ab3c6a626b047473f6f4854955cd4e0213f
-
SHA512
a3245fcfc944514a0a28e9e0887eeba7b971fdc2a7c5168e4b3311f38a2bdc2692800fc7e42e64938e7ec91b9f4dcdb57f77d33f5dcc2e36e8590c065e2f698f
-
SSDEEP
24576:w6LGRV7EMd5A5/B81TJvWkw1RaksEloH6KWUIuYYTcrL7VF3JOkK74gYx:w6qRV7EMd5A561TKTPTsW8A34NYx
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4356 set thread context of 1104 4356 109.exe 81 -
Program crash 1 IoCs
pid pid_target Process procid_target 860 1104 WerFault.exe 81 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4356 109.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1104 109.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4356 wrote to memory of 1104 4356 109.exe 81 PID 4356 wrote to memory of 1104 4356 109.exe 81 PID 4356 wrote to memory of 1104 4356 109.exe 81 PID 4356 wrote to memory of 1104 4356 109.exe 81 PID 4356 wrote to memory of 1104 4356 109.exe 81 PID 4356 wrote to memory of 1104 4356 109.exe 81 PID 4356 wrote to memory of 1104 4356 109.exe 81 PID 4356 wrote to memory of 1104 4356 109.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\109.exe"C:\Users\Admin\AppData\Local\Temp\109.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\109.exeC:\Users\Admin\AppData\Local\Temp\109.exe2⤵
- Suspicious use of UnmapMainImage
PID:1104 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 123⤵
- Program crash
PID:860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 11041⤵PID:4668