Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
07/10/2023, 18:27
Behavioral task
behavioral1
Sample
35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe
Resource
win10v2004-20230915-en
General
-
Target
35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe
-
Size
5.6MB
-
MD5
569e1206f7297afb742f46bdf31fee02
-
SHA1
b1c9380326197113a8b97859756d37fca1ac8b62
-
SHA256
35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814
-
SHA512
87c40a4a5a28b1ef5c8e9233c311f107ecea62cf0956c698734e9a275cae91e32b87e89edffd7c123575203dff9da1d855707e3dd8a34f7a1002b3019267a725
-
SSDEEP
98304:2BtaRDu2xK7yzs3fOVhZJjXofZW1cYtSd9Si1G+1XNM2MCDTOf5xNqY:2PaRDu2grOtJjX4ocr9VPPD0x
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2992-0-0x0000000000400000-0x0000000001F20000-memory.dmp vmprotect behavioral1/memory/2992-5-0x0000000000400000-0x0000000001F20000-memory.dmp vmprotect behavioral1/memory/2992-42-0x0000000000400000-0x0000000001F20000-memory.dmp vmprotect behavioral1/memory/2992-43-0x0000000000400000-0x0000000001F20000-memory.dmp vmprotect behavioral1/memory/2992-44-0x0000000000400000-0x0000000001F20000-memory.dmp vmprotect -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2992 35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe 2992 35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2992 35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe 2992 35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe"C:\Users\Admin\AppData\Local\Temp\35ebfba16207b69d197f739bab792d86c40ad1ebc3dd7478c84deae87ed7d814.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2992