Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ccdb36770fa2a9f6d9c29975227cceb.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ccdb36770fa2a9f6d9c29975227cceb.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
0ccdb36770fa2a9f6d9c29975227cceb.exe
-
Size
58KB
-
MD5
0ccdb36770fa2a9f6d9c29975227cceb
-
SHA1
752a3415654418447695a0ec387512af9fd2eeca
-
SHA256
b9df6f8fe446d60b971a35e0532410bd21ce5e78c138416f6c8d4cbbe67175b0
-
SHA512
ff0bbdb0f4f1b79ca62ef1f2a6aa7de311d21be8c6330997b4d4cd3bf3f11f19993cf8a86cd801e22b350094321c5bdca0d7169d363827d7dbcd3e19955eefbe
-
SSDEEP
768:fevFI1m0on6HGavZUdQffoaFNnioNQpMGZXlFPVrqX9zm3yr53nm5GMuMQC3aT3:itV6HGavhgamfRK9zm30dnvfM1az
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2880 0ccdb36770fa2a9f6d9c29975227cceb.exe 2880 0ccdb36770fa2a9f6d9c29975227cceb.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2880 wrote to memory of 1248 2880 0ccdb36770fa2a9f6d9c29975227cceb.exe 14 PID 2880 wrote to memory of 1248 2880 0ccdb36770fa2a9f6d9c29975227cceb.exe 14 PID 2880 wrote to memory of 1248 2880 0ccdb36770fa2a9f6d9c29975227cceb.exe 14 PID 2880 wrote to memory of 1248 2880 0ccdb36770fa2a9f6d9c29975227cceb.exe 14
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\0ccdb36770fa2a9f6d9c29975227cceb.exe"C:\Users\Admin\AppData\Local\Temp\0ccdb36770fa2a9f6d9c29975227cceb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880
-