Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

1

rutserv.exe

windows7-x64

5

rutserv.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    122s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2023, 21:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    rutserv.exe

  • Size

    19.8MB

  • MD5

    41dc282cbf89b0737ae6dd2de5a71015

  • SHA1

    4aac4bafaf43be690089549584770f9e88630b45

  • SHA256

    b8049a022430c34f0b8b3c9f357a9afa4fd6cb940b7353a610d1f53fb5bf471c

  • SHA512

    ee8f3af6c633385eb1c7022189604c16948fd9fb0da1eb017d529872df2f075b26bdc158cf2ef4772237f338d87d9f6dc1944381cd65c5a636add0e22a599d6d

  • SSDEEP

    196608:anhOP/yO920X/pYwSsfCMrCTSFXpoFZnEI6TNnXG8QItwZr/dJnvu9b9PjpA6:ihOPadU/RXKgBZwnCYZr/n29h

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rutserv.exe
    "C:\Users\Admin\AppData\Local\Temp\rutserv.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2436-0-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2436-1-0x0000000000400000-0x0000000001897000-memory.dmp

    Filesize

    20.6MB

    Download