Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c87bc0f34e79c7b61acddcd32505aa8.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0c87bc0f34e79c7b61acddcd32505aa8.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
0c87bc0f34e79c7b61acddcd32505aa8.exe
-
Size
60KB
-
MD5
0c87bc0f34e79c7b61acddcd32505aa8
-
SHA1
7e49b455907d21615db2b782f1e0a53609e12873
-
SHA256
bb1ebc5af256ac353b8ca2bd646363f73c93325698e65ff29fbd72e894113475
-
SHA512
7f8f244a141c42266e39d8eb89d92ed3275ef6745b6590b84dff13b2dcdaadddb61c37acd05873adf93036498c7898553cc0c06065c78442b3c7e95def2c5806
-
SSDEEP
1536:wzjsCiX1owiDJe8E1iEb0Edu/GHoWAjl857S67qpYS:wvUXdi4+Eb/du/GIZ47SKq2S
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5o1dyoo.exe 0c87bc0f34e79c7b61acddcd32505aa8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5o1dyoo.exe 0c87bc0f34e79c7b61acddcd32505aa8.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2076 set thread context of 2664 2076 0c87bc0f34e79c7b61acddcd32505aa8.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2664 0c87bc0f34e79c7b61acddcd32505aa8.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2664 2076 0c87bc0f34e79c7b61acddcd32505aa8.exe 28 PID 2076 wrote to memory of 2664 2076 0c87bc0f34e79c7b61acddcd32505aa8.exe 28 PID 2076 wrote to memory of 2664 2076 0c87bc0f34e79c7b61acddcd32505aa8.exe 28 PID 2076 wrote to memory of 2664 2076 0c87bc0f34e79c7b61acddcd32505aa8.exe 28 PID 2076 wrote to memory of 2664 2076 0c87bc0f34e79c7b61acddcd32505aa8.exe 28 PID 2076 wrote to memory of 2664 2076 0c87bc0f34e79c7b61acddcd32505aa8.exe 28 PID 2664 wrote to memory of 1200 2664 0c87bc0f34e79c7b61acddcd32505aa8.exe 6 PID 2664 wrote to memory of 1200 2664 0c87bc0f34e79c7b61acddcd32505aa8.exe 6 PID 2664 wrote to memory of 1200 2664 0c87bc0f34e79c7b61acddcd32505aa8.exe 6
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\0c87bc0f34e79c7b61acddcd32505aa8.exe"C:\Users\Admin\AppData\Local\Temp\0c87bc0f34e79c7b61acddcd32505aa8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\0c87bc0f34e79c7b61acddcd32505aa8.exe"C:\Users\Admin\AppData\Local\Temp\0c87bc0f34e79c7b61acddcd32505aa8.exe"3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2664
-
-