Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
17/11/2023, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe
Resource
win10v2004-20231023-en
General
-
Target
eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe
-
Size
3.7MB
-
MD5
9dc768c407a28468d6135ebec014d13d
-
SHA1
2d37b505ec78b9e923a9cc173410beddd07c78da
-
SHA256
eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214
-
SHA512
b36fbb436ee335d986a1922947803f4d068d886847ce74c3f27e1c71491c97281b00b84180fa996407b3d8a9010b6318f789bdc5a6c89b5eff7694092e848aa1
-
SSDEEP
49152:9NrYtbAbbc0CGVHCcOxqoppLXCIYrKMtlBdukXK6f/8LYFlNKVZijqC07GDoslXv:9rbc0dxOfbCIYflBduQn8gu/0fXv
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\J: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\R: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\Y: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\E: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\G: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\I: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\M: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\U: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\W: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\X: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\A: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\L: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\N: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\P: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\S: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\V: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\H: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\K: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\O: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\Q: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\T: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe File opened (read-only) \??\Z: eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe"C:\Users\Admin\AppData\Local\Temp\eea540cd4d2bab49db32e6fef7f5a19228a9b3e9692f0b02797b655405d77214.exe"1⤵
- Enumerates connected drives
- Checks processor information in registry
- Enumerates system info in registry
PID:856