Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2023, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
cd1a4174fe99f60f4ad3358129842792b62ec13a9410b71b805eed0199c8d57e.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
cd1a4174fe99f60f4ad3358129842792b62ec13a9410b71b805eed0199c8d57e.exe
Resource
win10v2004-20230621-en
General
-
Target
cd1a4174fe99f60f4ad3358129842792b62ec13a9410b71b805eed0199c8d57e.exe
-
Size
698KB
-
MD5
53942347098701dc861a302e5fa1ae45
-
SHA1
8aa7b1d868b6e63fe8be3f514402037b9207606c
-
SHA256
cd1a4174fe99f60f4ad3358129842792b62ec13a9410b71b805eed0199c8d57e
-
SHA512
5396a3ee4b57304abf08d53bffbd514da21fd559c7ce728a440aa46b76a2d42d9efda6abea9191f663d89d2941b0deddc089b5f182cbbd32dcd4c6e0ced41691
-
SSDEEP
12288:UICF573kkZ4RbVdHwiZrvh9OAIOQ2DiKBNwJTPMP:UIWbkkZ4RbVdHwiZrvhIAdQiLBNwRs
Malware Config
Signatures
-
Drops file in System32 directory 8 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{ADF4028F-6FF9-48B8-ADFB-9C49F1E2ADD1}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{78A8F9D1-FB78-468B-BE20-69975948AD9B}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{BCD35282-CE1F-4869-B4BD-63EBCD17527F}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{B8CB4AA9-D13C-45AB-B3CA-C702CBE88104}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{2AB63B7C-0FCD-41E7-97DF-3A6C62745787}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{5F33A2EE-30D5-46F5-AFEA-1DE1CF82D809}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{D34AFA8F-43B6-497E-8994-2B943FA1A5C2}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{040DEA0E-2DDA-4639-B03C-358135FD77F8}.catalogItem svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd1a4174fe99f60f4ad3358129842792b62ec13a9410b71b805eed0199c8d57e.exe"C:\Users\Admin\AppData\Local\Temp\cd1a4174fe99f60f4ad3358129842792b62ec13a9410b71b805eed0199c8d57e.exe"1⤵PID:2056
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
PID:2004