Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
242s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 10:40
Static task
static1
Behavioral task
behavioral1
Sample
eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
Resource
win10v2004-20221111-en
General
-
Target
eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe
-
Size
123KB
-
MD5
7dbbe0d2150a671d7f65b4c387d68773
-
SHA1
5329662abbeef51f47e9283c704a9dae1e0fcb61
-
SHA256
eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1
-
SHA512
e20d6eab7ecc36cbfc42d1c86caf533b2bdca649f453fc85f7773cae33d4aa6a53c266261a584ae7889084bf0623898bb058fb6bda483e3d56a17870a12e1c3f
-
SSDEEP
3072:XLF9CWADbxOhoFQ8G6felNwb4mj32OVuGEU8iW+:7F9CR1OhoC83b2kuBqD
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1100 set thread context of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27 PID 1100 wrote to memory of 940 1100 eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe"C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exeC:\Users\Admin\AppData\Local\Temp\eb29e3eccc62d461b4ab91f7befd6b7e44f2ed5c93f2a430bb53df951e4469b1.exe2⤵PID:940
-