Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 20:08
Static task
static1
Behavioral task
behavioral1
Sample
3a4509b9b97b571c302edcb211b38fbf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a4509b9b97b571c302edcb211b38fbf.exe
Resource
win10v2004-20231222-en
General
-
Target
3a4509b9b97b571c302edcb211b38fbf.exe
-
Size
144KB
-
MD5
3a4509b9b97b571c302edcb211b38fbf
-
SHA1
186967981ddf2c93287a8b834027974ab146caf4
-
SHA256
5adbd37afeff1028ecea8a71ca31464461304d33f1220b80d99632c5a4453f91
-
SHA512
6862861210bedd986f1d77e03bd4afad29a930ec2bd9f7bb1178ca509afa2eb4d0bcb8407305ab6b574f48c6dd7fae10b4b1b2e9bbc94c05d3b06ff826ca0cec
-
SSDEEP
1536:RwkqP1/1yo0Wnchx/X+07DDpFlgYrhp7gX4XFv3AVrlFIS39/oLa:RvqPx1CmchE0PDvhp7i4VvQvFX39/b
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\host7 3a4509b9b97b571c302edcb211b38fbf.exe -
Deletes itself 1 IoCs
pid Process 2744 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1820 set thread context of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\pokoz.sys 3a4509b9b97b571c302edcb211b38fbf.exe File opened for modification C:\Windows\pokoz.sys 3a4509b9b97b571c302edcb211b38fbf.exe File created C:\Windows\sdel.bat 3a4509b9b97b571c302edcb211b38fbf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2372 3a4509b9b97b571c302edcb211b38fbf.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 484 Process not Found -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 1820 wrote to memory of 2372 1820 3a4509b9b97b571c302edcb211b38fbf.exe 28 PID 2372 wrote to memory of 2744 2372 3a4509b9b97b571c302edcb211b38fbf.exe 30 PID 2372 wrote to memory of 2744 2372 3a4509b9b97b571c302edcb211b38fbf.exe 30 PID 2372 wrote to memory of 2744 2372 3a4509b9b97b571c302edcb211b38fbf.exe 30 PID 2372 wrote to memory of 2744 2372 3a4509b9b97b571c302edcb211b38fbf.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Windows\sdel.bat" "C:\Users\Admin\AppData\Local\Temp\3a4509b9b97b571c302edcb211b38fbf.exe""3⤵
- Deletes itself
PID:2744
-
-