Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    27s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 10:40

General

  • Target

    c68d9819dc05b7a0824cf434426799666e46827ff8f1970a5d7d4cdbc6817d92.exe

  • Size

    79KB

  • MD5

    2ba53f058e07cfe467ff7250256df977

  • SHA1

    8f12b76e9d8e2815cd56dafbb286c621eeb1f142

  • SHA256

    c68d9819dc05b7a0824cf434426799666e46827ff8f1970a5d7d4cdbc6817d92

  • SHA512

    2a8c800884e939cc7d594897725becbda6fbbe3ea9962b1f6665eba75e25ac144140af81cc5c2e4fd0c355d253990da1a16383dca8d2e9297301df35d83bebbf

  • SSDEEP

    1536:W2IZM93et87VXjhNZ/Fb2x6KY4G2H6d9fY03JZFU:jIZWe4hNlC8KYL2aHfLrU

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1300
      • C:\Users\Admin\AppData\Local\Temp\c68d9819dc05b7a0824cf434426799666e46827ff8f1970a5d7d4cdbc6817d92.exe
        "C:\Users\Admin\AppData\Local\Temp\c68d9819dc05b7a0824cf434426799666e46827ff8f1970a5d7d4cdbc6817d92.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:908
        • C:\Users\Admin\AppData\Local\Temp\c68d9819dc05b7a0824cf434426799666e46827ff8f1970a5d7d4cdbc6817d92.exe
          C:\Users\Admin\AppData\Local\Temp\c68d9819dc05b7a0824cf434426799666e46827ff8f1970a5d7d4cdbc6817d92.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1932

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/908-58-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/908-60-0x0000000000280000-0x00000000002B5000-memory.dmp

      Filesize

      212KB

    • memory/908-61-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/1300-64-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB

    • memory/1932-56-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1932-62-0x0000000000400000-0x00000000004083A0-memory.dmp

      Filesize

      32KB

    • memory/1932-63-0x0000000075131000-0x0000000075133000-memory.dmp

      Filesize

      8KB

    • memory/1932-67-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB