Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09/10/2023, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
Resource
win10v2004-20230915-en
General
-
Target
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
-
Size
2.2MB
-
MD5
fbf88f5b73ed2e893834ad27f3e2c133
-
SHA1
048ecd071ee7c51abfad511519f26875ab593e56
-
SHA256
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3
-
SHA512
75dce88b2d9f97b610b3821934e681a297e1dd4af2044ea50a8a26c55d23ed8de228df08acb2aa7bdb298a5b24cf3d0b08af7d73a105db69177c40660f716d4d
-
SSDEEP
24576:HsxHA8D1HT4jmQdbXf0qMmclpKmXG4yC8uhuXG+u8j0b2pS82EEN5jqu2+tEBADf:kfJ+dL0ZBlpSLuo1pIneu2UDTtPN
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2452-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-13-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-44-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-46-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2452-47-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2452 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2452 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe 2452 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe 2452 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe"C:\Users\Admin\AppData\Local\Temp\0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2452