Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
31/08/2023, 20:16
Static task
static1
Behavioral task
behavioral1
Sample
4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe
Resource
win10v2004-20230703-en
General
-
Target
4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe
-
Size
1.6MB
-
MD5
353dcfecd8e56fdb5cb4d9d94ed39769
-
SHA1
df4c974adcac6217562f88efc4ef6ffd7db70e71
-
SHA256
4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c
-
SHA512
74b94c11e4fa9da5d6fc26746a614628c8ec995d21e88593c671155a1b27a3e5e53114e07e3bfab578bd6358b3f7801708c51d816a64390656c48b7165e76975
-
SSDEEP
24576:eWDKWJHvxfwLG76Pl7Sx7Zme5Eyt5fnUNtqyO0DbY1XQfVh:eHLG5x7BeyDnUrpUM
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/864-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-7-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-9-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/864-47-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2944 864 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 864 wrote to memory of 2944 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe 28 PID 864 wrote to memory of 2944 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe 28 PID 864 wrote to memory of 2944 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe 28 PID 864 wrote to memory of 2944 864 4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe"C:\Users\Admin\AppData\Local\Temp\4b4b019c1f495c7ac508e0351fc1e6a13f4f549ac607bc4cc101f4dae002d51c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 3322⤵
- Program crash
PID:2944
-