Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 15:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
786f38085171917a33d6f9f47c84182d.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
786f38085171917a33d6f9f47c84182d.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
786f38085171917a33d6f9f47c84182d.exe
-
Size
3.1MB
-
MD5
786f38085171917a33d6f9f47c84182d
-
SHA1
3982f207cb58103c83179a637198d37370ca13a8
-
SHA256
52e7ac11eb76e5226418a35a2733c58a746b1e007a66d7f5b5a3977136bd6daf
-
SHA512
5623306f9fe78810af2ea3fb2aafeae0f7706242622887e99ce382bafac10c63f303b5ecf3b876e3355cf09357d5b59666826d242bdc2ba4d89d0c174637b55b
-
SSDEEP
98304:5mSWOiIyU7BdTxs73XNfJVLUjH5oxFbxx:5XhXT639RVUjZEdx
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2532 BE3.tmp -
Loads dropped DLL 1 IoCs
pid Process 2144 786f38085171917a33d6f9f47c84182d.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2532 2144 786f38085171917a33d6f9f47c84182d.exe 18 PID 2144 wrote to memory of 2532 2144 786f38085171917a33d6f9f47c84182d.exe 18 PID 2144 wrote to memory of 2532 2144 786f38085171917a33d6f9f47c84182d.exe 18 PID 2144 wrote to memory of 2532 2144 786f38085171917a33d6f9f47c84182d.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\786f38085171917a33d6f9f47c84182d.exe"C:\Users\Admin\AppData\Local\Temp\786f38085171917a33d6f9f47c84182d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp" --splashC:\Users\Admin\AppData\Local\Temp\786f38085171917a33d6f9f47c84182d.exe 799A06B4F8E21C72DE25913B9227497CCE1924654D51A15AD73E3C3B33D38684A950074409FA1DBB5CB028459794602896039712268D5C487C39EDB3D211ED112⤵
- Executes dropped EXE
PID:2532
-