Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe
Resource
win10v2004-20220812-en
General
-
Target
e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe
-
Size
157KB
-
MD5
179b6f8293556dda8dd4618686646af0
-
SHA1
9da30ce49f793e41b7f7cfb1d35a18b293b151a2
-
SHA256
e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485
-
SHA512
14f20aded7f0f03c3a2609b8b3e2cfcd0efbf205504792ed9bd9d960fdca7a5d240b5bb04ce945ffe6ab733373b5b23409d446fd8283607619cfe98f1215171a
-
SSDEEP
1536:gkWbhgW5o1oS4l1TfG8Umu3/IdsGmPIxl8F4L0a8fcqQA65Oi:FW+1oS4l5OeuQdrmwvL8EqQA65Oi
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\24275 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\cciadkyhv.pif" msiexec.exe -
Blocklisted process makes network request 25 IoCs
flow pid Process 3 956 msiexec.exe 4 956 msiexec.exe 5 956 msiexec.exe 6 956 msiexec.exe 7 956 msiexec.exe 8 956 msiexec.exe 9 956 msiexec.exe 10 956 msiexec.exe 11 956 msiexec.exe 12 956 msiexec.exe 13 956 msiexec.exe 14 956 msiexec.exe 15 956 msiexec.exe 16 956 msiexec.exe 17 956 msiexec.exe 18 956 msiexec.exe 19 956 msiexec.exe 20 956 msiexec.exe 21 956 msiexec.exe 22 956 msiexec.exe 23 956 msiexec.exe 24 956 msiexec.exe 25 956 msiexec.exe 26 956 msiexec.exe 27 956 msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2040 set thread context of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\cciadkyhv.pif msiexec.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 PID 2040 wrote to memory of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 PID 2040 wrote to memory of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 PID 2040 wrote to memory of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 PID 2040 wrote to memory of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 PID 2040 wrote to memory of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 PID 2040 wrote to memory of 1664 2040 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 28 PID 1664 wrote to memory of 956 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 29 PID 1664 wrote to memory of 956 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 29 PID 1664 wrote to memory of 956 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 29 PID 1664 wrote to memory of 956 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 29 PID 1664 wrote to memory of 956 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 29 PID 1664 wrote to memory of 956 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 29 PID 1664 wrote to memory of 956 1664 e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe"C:\Users\Admin\AppData\Local\Temp\e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe"C:\Users\Admin\AppData\Local\Temp\e7da4b735f0ad0e57923ef9a0a69a4849b9bdefac0e5d36bfc9fdcfed34c6485.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\syswow64\msiexec.exeC:\Windows\syswow64\msiexec.exe3⤵
- Adds policy Run key to start application
- Blocklisted process makes network request
- Drops file in Program Files directory
PID:956
-
-