Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
320557d8b53...e2.exe
windows7-x64
320557d8b53...e2.exe
windows10-2004-x64
725367c9554...22.exe
windows7-x64
325367c9554...22.exe
windows10-2004-x64
35119c03df1...4d.exe
windows7-x64
105119c03df1...4d.exe
windows10-2004-x64
105434c5c18f...98.exe
windows7-x64
105434c5c18f...98.exe
windows10-2004-x64
106631a01942...f8.exe
windows7-x64
36631a01942...f8.exe
windows10-2004-x64
107992c95955...79.exe
windows7-x64
47992c95955...79.exe
windows10-2004-x64
58452fe5158...32.exe
windows7-x64
78452fe5158...32.exe
windows10-2004-x64
79262fc6203...d6.exe
windows7-x64
109262fc6203...d6.exe
windows10-2004-x64
10Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 12:36
Static task
static1
Behavioral task
behavioral1
Sample
20557d8b534b624b67bc6c659519d1e2.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
20557d8b534b624b67bc6c659519d1e2.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
25367c955449f48ffc7fd421f8a5f822.exe
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
25367c955449f48ffc7fd421f8a5f822.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral5
Sample
5119c03df1becd83ce7de22565c5fc4d.exe
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
5119c03df1becd83ce7de22565c5fc4d.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral7
Sample
5434c5c18f21ddfd15d423d6670b2f98.exe
Resource
win7-20231025-en
Behavioral task
behavioral8
Sample
5434c5c18f21ddfd15d423d6670b2f98.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral9
Sample
6631a01942a28fc0507a84c854310df8.exe
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
6631a01942a28fc0507a84c854310df8.exe
Resource
win10v2004-20231020-en
Behavioral task
behavioral11
Sample
7992c95955b88441a5ab498bc0364f79.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
7992c95955b88441a5ab498bc0364f79.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral13
Sample
8452fe515826ab6f43eff16918a40e32.exe
Resource
win7-20231023-en
Behavioral task
behavioral14
Sample
8452fe515826ab6f43eff16918a40e32.exe
Resource
win10v2004-20231025-en
Behavioral task
behavioral15
Sample
9262fc6203bfd7d41fa45e2976e60ad6.exe
Resource
win7-20231023-en
Behavioral task
behavioral16
Sample
9262fc6203bfd7d41fa45e2976e60ad6.exe
Resource
win10v2004-20231020-en
General
-
Target
25367c955449f48ffc7fd421f8a5f822.exe
-
Size
987KB
-
MD5
25367c955449f48ffc7fd421f8a5f822
-
SHA1
ea39dd8a123d8ffa664e2d91f8f27dfa27f8351b
-
SHA256
29cd7bf1c70867fc4c7b751e86dcc2d5543b23d92284c8421c829e33ca1589bf
-
SHA512
b928a8b8bf1207137b9d1f22ae6848fcaeccffdc8c0f0493250761265a4074a511429dd2599ee6a00e867ca1c78df79c25b33c840fda9df32fea1aefdc51b115
-
SSDEEP
12288:zkgmEQG1G/tf4LOL9FCgppwTz0v/rqQ9ABdMZmJdhIy1VqloXU/KM01EnFrVYlxd:FshEA9udx5u/nFuaakm
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2608 1736 WerFault.exe 27 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1736 25367c955449f48ffc7fd421f8a5f822.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2608 1736 25367c955449f48ffc7fd421f8a5f822.exe 28 PID 1736 wrote to memory of 2608 1736 25367c955449f48ffc7fd421f8a5f822.exe 28 PID 1736 wrote to memory of 2608 1736 25367c955449f48ffc7fd421f8a5f822.exe 28 PID 1736 wrote to memory of 2608 1736 25367c955449f48ffc7fd421f8a5f822.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\25367c955449f48ffc7fd421f8a5f822.exe"C:\Users\Admin\AppData\Local\Temp\25367c955449f48ffc7fd421f8a5f822.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 16842⤵
- Program crash
PID:2608
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf