Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe
Resource
win10v2004-20230703-en
General
-
Target
8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe
-
Size
10.6MB
-
MD5
139dadf6a207b55d80baa6d9dd3ad9ed
-
SHA1
468d6cf63ea111d57fba4acd4719a4d1190d852f
-
SHA256
8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275
-
SHA512
1d124683fa5603411ec856dbfed5e71b7f172f6b793f2df517fcf1177f84a915a765b82ffd0dd78de271f999ba65124afc5064400aba440532b25e72920c4068
-
SSDEEP
196608:l+Crq8KtK/qKhsMlMf3+8jRk4hw46ium/LUgT9Oa4j:l+CurKCKhp2+Y+4WriRUgT9Z4
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main 8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe Set value (str) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2492 8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe 2492 8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe 2492 8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe 2492 8f2a038a3db99032470ce73d1e14be23c926820bb8b4dfb9b5d5e2473335e275.exe