Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/07/2023, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
14013878658799951837.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
14013878658799951837.exe
Resource
win10v2004-20230703-en
General
-
Target
14013878658799951837.exe
-
Size
6.0MB
-
MD5
d59763dc21dca8f11680c1c06f21321e
-
SHA1
eb4e6fcff0a89daa8f39ee5af3e45737b0bb24b5
-
SHA256
e45ba4f91807634b98684857852ff1cccb45a727286d22f9a29732804b1ac88c
-
SHA512
be5222c6dec3380e0c70b09ddf35ac15ae477e5191b922e6db9f478fa6490119b50845ec14c72cbb9761126cb3b63dca7f49ece2a41f697a8f9edfaf029cd18b
-
SSDEEP
98304:+xXYmZKcTBJ/Vxug2ngpuEwRqoWv2iQuGvTIHyQbvISvgR+mcSnT8RTHCY1rrK2G:+hXAcTv/7uIpxwo2iQubHZbWFfo+eH
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1788 14013878658799951837.exe 1788 14013878658799951837.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 928 1788 WerFault.exe 29 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2952 schtasks.exe 3044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1788 14013878658799951837.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2952 1788 14013878658799951837.exe 30 PID 1788 wrote to memory of 2952 1788 14013878658799951837.exe 30 PID 1788 wrote to memory of 2952 1788 14013878658799951837.exe 30 PID 1788 wrote to memory of 2952 1788 14013878658799951837.exe 30 PID 1788 wrote to memory of 2192 1788 14013878658799951837.exe 32 PID 1788 wrote to memory of 2192 1788 14013878658799951837.exe 32 PID 1788 wrote to memory of 2192 1788 14013878658799951837.exe 32 PID 1788 wrote to memory of 2192 1788 14013878658799951837.exe 32 PID 1788 wrote to memory of 928 1788 14013878658799951837.exe 35 PID 1788 wrote to memory of 928 1788 14013878658799951837.exe 35 PID 1788 wrote to memory of 928 1788 14013878658799951837.exe 35 PID 1788 wrote to memory of 928 1788 14013878658799951837.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\14013878658799951837.exe"C:\Users\Admin\AppData\Local\Temp\14013878658799951837.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 5 /tn "MUI unattend action{A4F3H6J4-Q1V4N7A5E3J7J8-A1C4N6D4K7D4}" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MuiUnattend\MuiUnattend.exe"2⤵
- Creates scheduled task(s)
PID:2952
-
-
C:\Windows\SysWOW64\schtasks.exe/C /Query /XML /TN "MUI unattend action{A4F3H6J4-Q1V4N7A5E3J7J8-A1C4N6D4K7D4}"2⤵PID:2192
-
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /tn "MUI unattend action{A4F3H6J4-Q1V4N7A5E3J7J8-A1C4N6D4K7D4}" /XML "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\MuiUnattend\343657868764335"2⤵
- Creates scheduled task(s)
PID:3044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 1922⤵
- Program crash
PID:928
-