Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c833f3af396235c00ffae66590b9a74.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c833f3af396235c00ffae66590b9a74.exe
Resource
win10v2004-20231215-en
0 signatures
150 seconds
General
-
Target
0c833f3af396235c00ffae66590b9a74.exe
-
Size
9.6MB
-
MD5
0c833f3af396235c00ffae66590b9a74
-
SHA1
57c921e29c621c74ebf6b5d5609f68e6cfb6653e
-
SHA256
77b9ab6013a1ab0bc099e329cfd8af8bd3f6aa640634a3c70a9ccd0bf72c7242
-
SHA512
f6b6fb93f9f49ba9e73b945525805cb7cfa5107d10225db2a3edaaa69c145515318229ac73860f7c873c164e3fb248d3c2c1f5878056cfdc495e88775a36d920
-
SSDEEP
49152:EQFRHrmQG+yrV2FuEFmFuEXV2FuEFmPNuEFmP8FmFuEXV2FuEFiEF:EcK
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2828 p.exe -
Loads dropped DLL 2 IoCs
pid Process 1812 0c833f3af396235c00ffae66590b9a74.exe 1812 0c833f3af396235c00ffae66590b9a74.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main p.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2828 p.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2828 p.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2828 p.exe 2828 p.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1812 wrote to memory of 2828 1812 0c833f3af396235c00ffae66590b9a74.exe 28 PID 1812 wrote to memory of 2828 1812 0c833f3af396235c00ffae66590b9a74.exe 28 PID 1812 wrote to memory of 2828 1812 0c833f3af396235c00ffae66590b9a74.exe 28 PID 1812 wrote to memory of 2828 1812 0c833f3af396235c00ffae66590b9a74.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c833f3af396235c00ffae66590b9a74.exe"C:\Users\Admin\AppData\Local\Temp\0c833f3af396235c00ffae66590b9a74.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\p.exeC:\Users\Admin\AppData\Local\Temp\p.exe -run C:\Users\Admin\AppData\Local\Temp\0c833f3af396235c00ffae66590b9a74.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2828
-