Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/01/2023, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
3 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
7.4MB
-
MD5
0b0ce424899b2590815cd05b3600e187
-
SHA1
0f7ed9f7a3b8a5ff46a9379acf442e2d7c137f0b
-
SHA256
6dc10241f07d88ce686151f7c47c4e7ed0b182e5e221cdd3ed24af496a691af8
-
SHA512
abc826e7d69774e279a08fc79284cc78e3b3ac094d9bd1eb8fd87c690b2ae11d76d4b4f6e1be23906f3bdfa10b29b1d7372c5fb509bccee131b790debc763c8d
-
SSDEEP
49152:g+Jdw4DZ0GL0Prb/ThvO90d7HjmAFd4A64nsfJk5NHszDRcDN9imdfU3g3EAgeRB:3k3Yh6hMdmEeuDEmAzS5l
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1340 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1292 wrote to memory of 1340 1292 tmp.exe 27 PID 1292 wrote to memory of 1340 1292 tmp.exe 27 PID 1292 wrote to memory of 1340 1292 tmp.exe 27 PID 1340 wrote to memory of 544 1340 cmd.exe 29 PID 1340 wrote to memory of 544 1340 cmd.exe 29 PID 1340 wrote to memory of 544 1340 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\tmp.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 03⤵PID:544
-
-