Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bae4f9b595823fda269b3f1ac7c15360_JC.exe
Resource
win7-20230831-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
bae4f9b595823fda269b3f1ac7c15360_JC.exe
Resource
win10v2004-20230915-en
4 signatures
150 seconds
General
-
Target
bae4f9b595823fda269b3f1ac7c15360_JC.exe
-
Size
1.1MB
-
MD5
bae4f9b595823fda269b3f1ac7c15360
-
SHA1
0090a0bbfd3bf65a69607407075672021e795fc7
-
SHA256
951e5c59317aa5368bc06e3288c2f5957ea353296c6edafb1d482f17cc00c286
-
SHA512
5cb6fbcaf213c9452122e2678cc5851624cf997962dff85f71bcec9c94ab2a7317932db637fea2c5a607b4dee94eace2cb9d98e51f69a15997e6b42b41a29a38
-
SSDEEP
24576:okJnsEd+pQpmb00TIlXexS/FNscnOY+6Nyu:okJnsEd+GAbFIlXexStNsaO7bu
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\IMJPMIG9.10 = "C:\\WINDOWS\\system32\\svch0st.exe" bae4f9b595823fda269b3f1ac7c15360_JC.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows\CurrentVersion\Run\IMJPMIG9.10 = "C:\\WINDOWS\\system32\\svch0st.exe" bae4f9b595823fda269b3f1ac7c15360_JC.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\WINDOWS\SysWOW64\svch0st.exe bae4f9b595823fda269b3f1ac7c15360_JC.exe File opened for modification C:\WINDOWS\SysWOW64\svch0st.exe bae4f9b595823fda269b3f1ac7c15360_JC.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\WindowsUpdate\ bae4f9b595823fda269b3f1ac7c15360_JC.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1496 bae4f9b595823fda269b3f1ac7c15360_JC.exe 1496 bae4f9b595823fda269b3f1ac7c15360_JC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bae4f9b595823fda269b3f1ac7c15360_JC.exe"C:\Users\Admin\AppData\Local\Temp\bae4f9b595823fda269b3f1ac7c15360_JC.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1496