Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 12:34
Behavioral task
behavioral1
Sample
d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe
Resource
win10v2004-20220812-en
General
-
Target
d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe
-
Size
24KB
-
MD5
b93c48fbb70ad31b99e9b6df37774f28
-
SHA1
26b8759c7b1a61891c8682da982e556db099dd2b
-
SHA256
d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336
-
SHA512
edb2bf69c011cbc6c1049e8102b03e15bbd09d8ee89f7ae0ce9bddd0c5d58ddfef4a8ef229b17b126c458bef83108ed79989cd47388b9884655fcc8d994234f9
-
SSDEEP
768:MFb0czmb9HNaaDRDdQeDGolKsYnrtF60jgQAC4MR+6OokP:M50cSbPaaDfzaolKBnrtFR0QAC4MGP
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1632-57-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/912-58-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/1632-60-0x0000000000400000-0x0000000000414000-memory.dmp upx behavioral1/memory/912-62-0x0000000000400000-0x0000000000414000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 856 cmd.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\svchost.exe:ext.exe d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe File created C:\Windows\SysWOW64\fci.exe.exe:ext.exe d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe File opened for modification C:\Windows\SysWOW64\fci.exe.exe:ext.exe d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1632 set thread context of 912 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 28 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1632 wrote to memory of 912 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 28 PID 1632 wrote to memory of 912 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 28 PID 1632 wrote to memory of 912 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 28 PID 1632 wrote to memory of 912 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 28 PID 1632 wrote to memory of 912 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 28 PID 1632 wrote to memory of 856 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 29 PID 1632 wrote to memory of 856 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 29 PID 1632 wrote to memory of 856 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 29 PID 1632 wrote to memory of 856 1632 d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe"C:\Users\Admin\AppData\Local\Temp\d106613c48af7bc5fd34f7052d5ea9235bc87dcb649ff3d5640e42e687d52336.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:912
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\1769475.bat2⤵
- Deletes itself
PID:856
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
299B
MD5bf2835bac2ac65a203dd1d88de0d20d5
SHA182dc99d63a4f3059573a68ab4475f37617362bf4
SHA2568ae5291ca2c6a6590a1ab099225e41836e52832f8fbe29d910399b1fdf82202c
SHA512bbcc77fe23d952c43e6052e88b37beb00996a82329020b8ffdf65a49fe3ff97fc9d03c39845b9d69d604b369e5e6a1645cc1c8bc3052da7a8f23fdd311ff966b