Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28/11/2022, 01:27
Behavioral task
behavioral1
Sample
35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
Resource
win10v2004-20220812-en
General
-
Target
35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
-
Size
3.7MB
-
MD5
24ce983be50beaa6ffd75e062150df25
-
SHA1
95ff5f560eeb99955282785b7ac84b93fc81bbeb
-
SHA256
35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50
-
SHA512
492a241668b2f8b77ed9caed916c999906a58ab10c41359f2fed7757615770d83b37a5ccef70c1aa3c5c246bdb56fbb4cdf922c20f5ba87d383aad1eb7b37127
-
SSDEEP
98304:baYWXRBUuDwXl4NAO25wQXLVM0zPU6HR7oj:bWBBlS4rA3JMenHhoj
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/856-55-0x00000000009A0000-0x0000000001120000-memory.dmp upx behavioral1/memory/856-56-0x00000000009A0000-0x0000000001120000-memory.dmp upx -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\q: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\s: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\x: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\y: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\a: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\g: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\m: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\p: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\z: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\i: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\k: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\u: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\n: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\r: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\t: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\v: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\b: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\f: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\h: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\j: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\w: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\e: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\l: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe File opened (read-only) \??\o: 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/856-56-0x00000000009A0000-0x0000000001120000-memory.dmp autoit_exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 856 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 856 35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe"C:\Users\Admin\AppData\Local\Temp\35d68e31c292c6afec6ce3342215b215a3e0d391c68fb9f39e2295d3a3c22e50.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:856