Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/01/2023, 11:41

230113-nthbwsgf38 10

12/01/2023, 16:59

230112-vhc2csgg84 5

11/01/2023, 18:21

230111-wzsntahf31 5

Analysis

  • max time kernel
    44s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2023, 16:59

General

  • Target

    Software.exe

  • Size

    449.2MB

  • MD5

    d5f6325ec94040f2a6ad638378f68863

  • SHA1

    b577eebec521d0c252426ce01d0a85e405619e84

  • SHA256

    87c7a6eb8d9ec5de571f3f3283d2b5f857d2eb9a262ccb11d9cbae9da8b649af

  • SHA512

    9da7cb47b04618d05c0477656c82f500080e6b4325eefe5f4d87d3d11a171fcbcfe830b676e419961378217be2c9a93040c361ae30c62de1a39d76e921bb06eb

  • SSDEEP

    24576:Rgh/xuMApac4x8buUjQs5nyyx+NxEyaQ:ih/rApz4xauUMs5nyC+NqyaQ

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Software.exe
    "C:\Users\Admin\AppData\Local\Temp\Software.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:616
    • C:\Users\Admin\AppData\Local\Temp\Software.exe
      "C:\Users\Admin\AppData\Local\Temp\Software.exe"
      2⤵
        PID:584

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/584-60-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/584-61-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/584-63-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/584-65-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/584-66-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

    • memory/616-54-0x0000000000140000-0x0000000000226000-memory.dmp

      Filesize

      920KB

    • memory/616-55-0x0000000075931000-0x0000000075933000-memory.dmp

      Filesize

      8KB

    • memory/616-56-0x0000000000590000-0x00000000005A6000-memory.dmp

      Filesize

      88KB

    • memory/616-57-0x00000000005B0000-0x00000000005BA000-memory.dmp

      Filesize

      40KB

    • memory/616-58-0x0000000002040000-0x000000000209C000-memory.dmp

      Filesize

      368KB

    • memory/616-59-0x00000000020E0000-0x0000000002102000-memory.dmp

      Filesize

      136KB