Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe
Resource
win7-20220812-en
4 signatures
150 seconds
General
-
Target
9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe
-
Size
152KB
-
MD5
df7c5a731b42cd427f138f8bfdc2fc86
-
SHA1
c37707932a4c474d5fae8cd06ab5ded60e4a5505
-
SHA256
9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d
-
SHA512
2391a237fe108aebd2746f1e51967b67fa28208f4faf8c27ff65708ab84cf7b156d232883ce52ebcb5700aae9d1b3791c5d464148c0263f63677f352173459b5
-
SSDEEP
3072:6yzSoVToBSpx6L/7FYgXIg0lkZFDiI9Z7vt4kHp8E2n2XDWBR3r/pWD:6KXoBHxYg0lkjt4Q22XDoRb/A
Malware Config
Signatures
-
NetWire RAT payload 5 IoCs
resource yara_rule behavioral1/memory/856-62-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/856-66-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/856-68-0x00000000004021DA-mapping.dmp netwire behavioral1/memory/856-72-0x0000000000400000-0x000000000041E000-memory.dmp netwire behavioral1/memory/856-73-0x0000000000400000-0x000000000041E000-memory.dmp netwire -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 968 set thread context of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28 PID 968 wrote to memory of 856 968 9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe"C:\Users\Admin\AppData\Local\Temp\9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe"C:\Users\Admin\AppData\Local\Temp\9ab706cf606dd33db4de163677202492b81e9951754c5e6d75ed1f726560ac8d.exe"2⤵PID:856
-