Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 13:43
Static task
static1
Behavioral task
behavioral1
Sample
711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe
Resource
win10v2004-20221111-en
General
-
Target
711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe
-
Size
62KB
-
MD5
701d52c18945c7191b7cacea1d8c1c05
-
SHA1
b8f560dcc9abb1861cd7fdf6771cb8dbb01c5041
-
SHA256
711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d
-
SHA512
1e0a640275f62f73fe17ffe72b8c864228741a822a5dc9e196205e14607df457e6b33e0d47737b6499a66425475ba6d6302daa85609340c42a22cfcfd97f524c
-
SSDEEP
1536:E25b7AbekJQ2dfh+6TE7MWwP5GuqhcJ3YXju:l5bci6pJTE7U5GuqhcJ3Yzu
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojetjyyj2.exe 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ojetjyyj2.exe 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 564 set thread context of 280 564 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 280 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 564 wrote to memory of 280 564 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 28 PID 564 wrote to memory of 280 564 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 28 PID 564 wrote to memory of 280 564 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 28 PID 564 wrote to memory of 280 564 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 28 PID 564 wrote to memory of 280 564 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 28 PID 564 wrote to memory of 280 564 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 28 PID 280 wrote to memory of 1220 280 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 20 PID 280 wrote to memory of 1220 280 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 20 PID 280 wrote to memory of 1220 280 711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe 20
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe"C:\Users\Admin\AppData\Local\Temp\711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe"C:\Users\Admin\AppData\Local\Temp\711f7f29ce32f5e67880577d240c38b39f30cabe084c5dd29e39169b74e50d2d.exe"3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:280
-
-