Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 10:59
Static task
static1
Behavioral task
behavioral1
Sample
c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe
Resource
win10v2004-20231222-en
General
-
Target
c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe
-
Size
60KB
-
MD5
6f343cb8a95b2d71ebf8862d27a4bfe3
-
SHA1
ed935256b791b794d0f66d29f1ac0bb4ce553898
-
SHA256
c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206
-
SHA512
b2fb1c5fc6f89a8c406ac0e801f77f66cb8daed05297933f7e0abd844d99f191df16c59883ed76a7c7975e3a9f263df8884e7c3f314783e318d94a6951923645
-
SSDEEP
768:ltT2yrM1VDTolkcHTa6Qy0sOF8P4V7wmdUm1a8kz0:3UPo5wF8PgZP1al0
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Upgrade Assistant = "explorer \"C:\\Users\\Admin\\Documents\\msedge.exe\"" c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe -
Blocklisted process makes network request 4 IoCs
flow pid Process 5 2940 msiexec.exe 9 2940 msiexec.exe 10 2940 msiexec.exe 11 2940 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2940 msiexec.exe 2940 msiexec.exe 2940 msiexec.exe 2940 msiexec.exe 2940 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30 PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30 PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30 PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30 PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30 PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30 PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30 PID 2324 wrote to memory of 2940 2324 c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe"C:\Users\Admin\AppData\Local\Temp\c524ec2c2fdf9acee447cca432634ca26396594cd83c078ad6092bbfda58c206.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe -Puppet2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2940
-