Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

7ccff17620...04.exe

windows7-x64

5

7ccff17620...04.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    82s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 13:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe

  • Size

    406KB

  • MD5

    7a62bb5ab82276f0cbdce398be804d76

  • SHA1

    6bf7b403573da68906312d29b810001ed0be26f4

  • SHA256

    7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204

  • SHA512

    fc6ec5bb2d50bbe57330e3cdfa5cc127864d334f22ec5630389771c6d5118544fbf45845b4dd09c17d8cde15996611b62b9adc0b73abe1439ecd86c182b5ba91

  • SSDEEP

    12288:tc//////olN/xJUIKt/GsiyGDIt6DZ4cYGZiX:tc//////olr6IWesBeIt4

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe
    "C:\Users\Admin\AppData\Local\Temp\7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Users\Admin\AppData\Local\Temp\7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe
      C:\Users\Admin\AppData\Local\Temp\7ccff176200e225e6a1caeb6913105a2f34168c0ac58d05f47917a078c797204.exe
      2⤵
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1612-133-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download

  • memory/1612-135-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download

  • memory/1612-136-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download

  • memory/1612-137-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download