Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 06:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b2145400fe9b11dd1048e4ba2f3bc8f.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b2145400fe9b11dd1048e4ba2f3bc8f.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
5b2145400fe9b11dd1048e4ba2f3bc8f.exe
-
Size
208KB
-
MD5
5b2145400fe9b11dd1048e4ba2f3bc8f
-
SHA1
f98a1da272c368fb1e0f467ba624064600c23253
-
SHA256
e0750dc16b5f93ba2f7f05dd6bb51a63ba8500c971cfd60b9d778db1d5a94ac5
-
SHA512
02ab94ce1ddb34aa3ed4220302171d1b57e45046af19058644fd4e26e9e70d3ef5fc10eeb10fc110f6bac252447cac8b228f16d81828a0c8088fc488bcedb3c0
-
SSDEEP
3072:w/Y+7IXdeOnVLyCGuVbh9sfp0Rip/j1B/Tuw8v/:67CtJh9sfp0gj1M/
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1888 set thread context of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2628 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 2628 5b2145400fe9b11dd1048e4ba2f3bc8f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 1888 wrote to memory of 2628 1888 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 17 PID 2628 wrote to memory of 1248 2628 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 21 PID 2628 wrote to memory of 1248 2628 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 21 PID 2628 wrote to memory of 1248 2628 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 21 PID 2628 wrote to memory of 1248 2628 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2628
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248