Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
Resource
win10v2004-20220812-en
General
-
Target
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe
-
Size
240KB
-
MD5
b9d564eb2bd9699c04fc0239bbb3b814
-
SHA1
9cfc9f538f747536158da96148ba8deec9fc4064
-
SHA256
ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031
-
SHA512
93b564486b640d21ff2955fd0431f4f86991d61c8e901681933221deb2104f22faf596675bca2297ecab108af864be5dcfcca8c2f9d61b0f8d573a7b0fe5842a
-
SSDEEP
6144:LWOipIA/VeF4qliVO1P5AiTNuKdJhNFEzX:LfipIA/Ve2qYIbTED
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1716 set thread context of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28 PID 1716 wrote to memory of 1972 1716 ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"C:\Users\Admin\AppData\Local\Temp\ba6f63a9bb2d4e7ce45cc283669c5d6df1ce3ad3fa55da5152b3bb4bdd286031.exe"2⤵PID:1972
-