Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
048cd9a81f8419dcd92620c9983ce9a0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
048cd9a81f8419dcd92620c9983ce9a0.exe
Resource
win10v2004-20231215-en
General
-
Target
048cd9a81f8419dcd92620c9983ce9a0.exe
-
Size
580KB
-
MD5
048cd9a81f8419dcd92620c9983ce9a0
-
SHA1
0393f8a1e55431bac93614b55f482223ff536638
-
SHA256
092d0c4356b7d9227b184190137ffe7c9916701f7ac6aa93e4f028bb3d5c7583
-
SHA512
1bcd749c35289f9383f1f12c46a9c551225ae3cfd85b65bf1efe68a541f13dc1c477dd4a74295ad0357bd4446b188f2b5870c04e12e6c9d936299bdc965212c2
-
SSDEEP
12288:3RteN723mmqw3CI0DO4asqWZzHjfUcBQwETtQ:3Re7xwCI0i4aXWNHjfrQfTtQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2384 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\Qkeycrypt 048cd9a81f8419dcd92620c9983ce9a0.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2052 048cd9a81f8419dcd92620c9983ce9a0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2052 048cd9a81f8419dcd92620c9983ce9a0.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2384 2052 048cd9a81f8419dcd92620c9983ce9a0.exe 28 PID 2052 wrote to memory of 2384 2052 048cd9a81f8419dcd92620c9983ce9a0.exe 28 PID 2052 wrote to memory of 2384 2052 048cd9a81f8419dcd92620c9983ce9a0.exe 28 PID 2052 wrote to memory of 2384 2052 048cd9a81f8419dcd92620c9983ce9a0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\048cd9a81f8419dcd92620c9983ce9a0.exe"C:\Users\Admin\AppData\Local\Temp\048cd9a81f8419dcd92620c9983ce9a0.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\048CD9~1.EXE > nul2⤵
- Deletes itself
PID:2384
-