Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
30/08/2023, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
RQ039423.PDF.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
RQ039423.PDF.exe
Resource
win10v2004-20230703-en
General
-
Target
RQ039423.PDF.exe
-
Size
745KB
-
MD5
a9236435368f55bbb462fd7d03a832b2
-
SHA1
75d703203a24ff7e6a0f451598837d57304bfa27
-
SHA256
abe0a6708bda47a3fad184d79e29e780300ce705aa45f04ee506e055ed50dbb8
-
SHA512
e19dc3e29dd1138bb4067f41168ae458811b0713f0f6530199b7a3fa4429de306bbb929dcf9b74058937250db02514d38aab820862c8b88e35b5fdbf0554b697
-
SSDEEP
12288:pv953k9WSr3qJlVsLGxQKDx/MDJI/BLHCPtUKSVgVI3ny6iZ7btZIlrcHewyQJ3y:pvnk9RMlV1xQKDx/MDJqBLsUNyC3x+7Z
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2196 set thread context of 2820 2196 RQ039423.PDF.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2820 RegSvcs.exe 2820 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2820 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30 PID 2196 wrote to memory of 2820 2196 RQ039423.PDF.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\RQ039423.PDF.exe"C:\Users\Admin\AppData\Local\Temp\RQ039423.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-