Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
110s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26/12/2022, 17:43
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
4 signatures
150 seconds
General
-
Target
file.exe
-
Size
583KB
-
MD5
bac22670cdf54898180a97af5167354b
-
SHA1
0fbd7308d065e0f2bd13f367e5973595a8faca9c
-
SHA256
ef9e2642cd75317c8491019600beeab1274892682829954e7339f847de5b22b5
-
SHA512
a7ab2456a26046675ce596b1d0b53d7caf9dc93d933b88d5e82f5c8d71c5f9eb83ba58cd47852e5d742ff5a1739d9f87213389058cd917a908a5238c7aad78dd
-
SSDEEP
12288:lk8yqhhsVLrhXPrid6UI5SZD/trT1un6DlS7AZHUquav76T5l:zgLd2dFTYn6xQACqS
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1360 set thread context of 1404 1360 file.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 376 1360 WerFault.exe 27 -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1360 wrote to memory of 1404 1360 file.exe 29 PID 1360 wrote to memory of 1404 1360 file.exe 29 PID 1360 wrote to memory of 1404 1360 file.exe 29 PID 1360 wrote to memory of 1404 1360 file.exe 29 PID 1360 wrote to memory of 1404 1360 file.exe 29 PID 1360 wrote to memory of 1404 1360 file.exe 29 PID 1360 wrote to memory of 376 1360 file.exe 30 PID 1360 wrote to memory of 376 1360 file.exe 30 PID 1360 wrote to memory of 376 1360 file.exe 30 PID 1360 wrote to memory of 376 1360 file.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:1404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1360 -s 482⤵
- Program crash
PID:376
-