Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10/05/2023, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
computer-open-admin-command-prompt.zip
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
computer-open-admin-command-prompt.zip
Resource
win10v2004-20230221-en
Behavioral task
behavioral3
Sample
computer-open-admin-command-prompt.reg
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
computer-open-admin-command-prompt.reg
Resource
win10v2004-20230220-en
General
-
Target
computer-open-admin-command-prompt.reg
-
Size
259B
-
MD5
6920520e8342e509701560787f476b9e
-
SHA1
ddd6167e911ae70a810fa25b36ef05f39f635841
-
SHA256
95bd8d6fb068c6e5c94968c86ea7ae60d75225423ccb1a0a8929133564b74266
-
SHA512
2f9560360b212cecfbcc4ea428812941aa7cf2448be833a01520d33f7ee9f81d4b5c8d3b2e6a6ffcf86ea616aefec7100b66986711bb75b66f5dd90df0249eac
Malware Config
Signatures
-
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas\command regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas\command\ = "cmd.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\shell\runas\ = "Open Command Prompt as Administrator" regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 1932 regedit.exe