Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe
Resource
win10v2004-20230915-en
General
-
Target
7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe
-
Size
1.4MB
-
MD5
123aa76988da88fc566579ce42326133
-
SHA1
f26a70dbd806d240fb82354db2f9744a1ca1ce16
-
SHA256
7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729
-
SHA512
85ca38b838c189a04faec969ec0816d140e093c12067e5660fc248b3b97b0ad0ef3cebc5396d6326af07481e9298c42c854a8617ee670d67d3bafc178bea8bad
-
SSDEEP
24576:6W8kfGnbsarSzff4pA0A26ZvGS1E6b2wweHXdmt7HIM6MQfoyl9GonB43cV4vo9B:CkubsarSzff4pA0A26ZvK6b4eAtH6M0D
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2580 set thread context of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 -
Program crash 1 IoCs
pid pid_target Process procid_target 2792 2356 WerFault.exe 30 -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2592 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 29 PID 2580 wrote to memory of 2592 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 29 PID 2580 wrote to memory of 2592 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 29 PID 2580 wrote to memory of 2592 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 29 PID 2580 wrote to memory of 2592 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 29 PID 2580 wrote to memory of 2592 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 29 PID 2580 wrote to memory of 2592 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 29 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2580 wrote to memory of 2356 2580 7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe 30 PID 2356 wrote to memory of 2792 2356 AppLaunch.exe 31 PID 2356 wrote to memory of 2792 2356 AppLaunch.exe 31 PID 2356 wrote to memory of 2792 2356 AppLaunch.exe 31 PID 2356 wrote to memory of 2792 2356 AppLaunch.exe 31 PID 2356 wrote to memory of 2792 2356 AppLaunch.exe 31 PID 2356 wrote to memory of 2792 2356 AppLaunch.exe 31 PID 2356 wrote to memory of 2792 2356 AppLaunch.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe"C:\Users\Admin\AppData\Local\Temp\7d209e143dbd5de2370b08adae692cebdd99422912d6857a485c840bc8af6729.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 2003⤵
- Program crash
PID:2792
-
-