Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
Resource
win10v2004-20220812-en
General
-
Target
b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe
-
Size
297KB
-
MD5
3c2d01fdb542900c95b6f0e5fbe9b17d
-
SHA1
75c9717525e65afe9093cb1014573cd133972321
-
SHA256
b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed
-
SHA512
c97c26940f94116d7f7e3602ee803010f77639ab939417d39d3256780fd8b0d2ee35c0f338b40266af6ddafb6e3f98f90d95e435a1cd8c4f0a2255a3ee3c99fe
-
SSDEEP
6144:dt8+VUuzgQKH7kNRfwF02oVPm3dMWVtQu7zVmHkko:dt8+VULQaF02oYNXVtl9mHkn
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1628-56-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1628-60-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1628-62-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral1/memory/1628-68-0x0000000000400000-0x0000000000472000-memory.dmp upx -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1400 set thread context of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 set thread context of 0 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe PID 1628 set thread context of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 1628 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 28 PID 1400 wrote to memory of 0 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe PID 1400 wrote to memory of 0 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe PID 1400 wrote to memory of 0 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe PID 1400 wrote to memory of 0 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe PID 1400 wrote to memory of 0 1400 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 1628 wrote to memory of 628 1628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 29 PID 628 wrote to memory of 1224 628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 10 PID 628 wrote to memory of 1224 628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 10 PID 628 wrote to memory of 1224 628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 10 PID 628 wrote to memory of 1224 628 b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe 10
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"C:\Users\Admin\AppData\Local\Temp\b7ac849fd0ed53b1c4d8192c0c212293bbb30bae12e5524dbd18fa843c0db6ed.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:628
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1224