Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2023, 10:50

General

  • Target

    7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe

  • Size

    1.4MB

  • MD5

    123aa76988da88fc566579ce42326133

  • SHA1

    f26a70dbd806d240fb82354db2f9744a1ca1ce16

  • SHA256

    7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729

  • SHA512

    85ca38b838c189a04faec969ec0816d140e093c12067e5660fc248b3b97b0ad0ef3cebc5396d6326af07481e9298c42c854a8617ee670d67d3bafc178bea8bad

  • SSDEEP

    24576:6W8kfGnbsarSzff4pA0A26ZvGS1E6b2wweHXdmt7HIM6MQfoyl9GonB43cV4vo9B:CkubsarSzff4pA0A26ZvK6b4eAtH6M0D

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe
    "C:\Users\Admin\AppData\Local\Temp\7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:2592
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 200
          3⤵
          • Program crash
          PID:2792

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2356-0-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-1-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-2-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-3-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-4-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-5-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2356-7-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-9-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB

    • memory/2356-11-0x0000000000400000-0x000000000053A000-memory.dmp

      Filesize

      1.2MB