Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
03/10/2023, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
Pedido de snorkel88793001.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Pedido de snorkel88793001.exe
Resource
win10v2004-20230915-en
General
-
Target
Pedido de snorkel88793001.exe
-
Size
1.6MB
-
MD5
65e0f14b01b2508fed95a90721d548d6
-
SHA1
c2d3b361df71699ffde4074e9576303fcecb30af
-
SHA256
53adecc01775047c7456f6a02f11ffaa6e9addaf2bbf718c3aef0cbcc2b135aa
-
SHA512
e86f8f1fb88b07353cfbff9d56f8fe262dfe32b7ce78a4ecc7f6232266055696e206df153f93b7b5a76d56ffc047752588769102f1d10f78b7b66558ee120389
-
SSDEEP
24576:hqMa57sJaGuq6a9DhvhUDpprRmM0scMUuIy+A+:hpsF5q6a3v+DpprRmM0sDUuIH
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2452 set thread context of 2972 2452 Pedido de snorkel88793001.exe 29 -
Program crash 1 IoCs
pid pid_target Process procid_target 2904 2452 WerFault.exe 27 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2972 AppLaunch.exe 2972 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2972 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2972 AppLaunch.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2972 2452 Pedido de snorkel88793001.exe 29 PID 2452 wrote to memory of 2904 2452 Pedido de snorkel88793001.exe 30 PID 2452 wrote to memory of 2904 2452 Pedido de snorkel88793001.exe 30 PID 2452 wrote to memory of 2904 2452 Pedido de snorkel88793001.exe 30 PID 2452 wrote to memory of 2904 2452 Pedido de snorkel88793001.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pedido de snorkel88793001.exe"C:\Users\Admin\AppData\Local\Temp\Pedido de snorkel88793001.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1362⤵
- Program crash
PID:2904
-