Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0badeaa15917cde11e4994539a536494.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0badeaa15917cde11e4994539a536494.exe
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
0badeaa15917cde11e4994539a536494.exe
-
Size
68KB
-
MD5
0badeaa15917cde11e4994539a536494
-
SHA1
105523ae48706cb5de88cc827d03d6f3197ca097
-
SHA256
56f1b4bc6868c62c62d258d1bf7b5927bc3c745a7825e22b2639eca18e1392f1
-
SHA512
6e05b8d0693d4c306547e25f7575bd6722509fdf072523d006f61c2116c9c5378569714fe90d2c3eccd6aef6cfa9437eea5c812d97ba74c9f61a9bd971a48124
-
SSDEEP
1536:3pz8+HptZUqIq7es/vKIlrEJkPUgrqQYldvq:3RJp/vzrENlN
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y8oj1dyytjy.exe 0badeaa15917cde11e4994539a536494.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y8oj1dyytjy.exe 0badeaa15917cde11e4994539a536494.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1732 set thread context of 1744 1732 0badeaa15917cde11e4994539a536494.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1744 0badeaa15917cde11e4994539a536494.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1744 1732 0badeaa15917cde11e4994539a536494.exe 28 PID 1732 wrote to memory of 1744 1732 0badeaa15917cde11e4994539a536494.exe 28 PID 1732 wrote to memory of 1744 1732 0badeaa15917cde11e4994539a536494.exe 28 PID 1732 wrote to memory of 1744 1732 0badeaa15917cde11e4994539a536494.exe 28 PID 1732 wrote to memory of 1744 1732 0badeaa15917cde11e4994539a536494.exe 28 PID 1732 wrote to memory of 1744 1732 0badeaa15917cde11e4994539a536494.exe 28 PID 1744 wrote to memory of 1220 1744 0badeaa15917cde11e4994539a536494.exe 15 PID 1744 wrote to memory of 1220 1744 0badeaa15917cde11e4994539a536494.exe 15 PID 1744 wrote to memory of 1220 1744 0badeaa15917cde11e4994539a536494.exe 15
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\0badeaa15917cde11e4994539a536494.exe"C:\Users\Admin\AppData\Local\Temp\0badeaa15917cde11e4994539a536494.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\0badeaa15917cde11e4994539a536494.exe"C:\Users\Admin\AppData\Local\Temp\0badeaa15917cde11e4994539a536494.exe"3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1744
-
-