Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 04:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ed051e7c5c9957a895e9bd0f388f03e.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ed051e7c5c9957a895e9bd0f388f03e.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
0ed051e7c5c9957a895e9bd0f388f03e.exe
-
Size
65KB
-
MD5
0ed051e7c5c9957a895e9bd0f388f03e
-
SHA1
fdf0a5083c2fe5e653ee3194b189b39d9482a659
-
SHA256
8539f8f926daf17befeefa3c2393d8299db6f8acce41a97956d1af7e9ebe8ba4
-
SHA512
4e898279000b571d5c7d1efd4e87b2045c7202dcf783b3f5c597428f85a4af76f2b51d1f8074a370d5022af8dc90315f6da5a438238514cad41886de9ec09e09
-
SSDEEP
1536:VdxqeQPTLXZdjK+gu9VREmnpsQxhegnx:HzCT7Tj24EmeQPegnx
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4348 svchoxt.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SysDesk = "C:\\Windows\\SysWOW64\\svchoxt.exe" svchoxt.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svchoxt.exe 0ed051e7c5c9957a895e9bd0f388f03e.exe File opened for modification C:\Windows\SysWOW64\svchoxt.exe 0ed051e7c5c9957a895e9bd0f388f03e.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4348 svchoxt.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1252 wrote to memory of 4348 1252 0ed051e7c5c9957a895e9bd0f388f03e.exe 17 PID 1252 wrote to memory of 4348 1252 0ed051e7c5c9957a895e9bd0f388f03e.exe 17 PID 1252 wrote to memory of 4348 1252 0ed051e7c5c9957a895e9bd0f388f03e.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ed051e7c5c9957a895e9bd0f388f03e.exe"C:\Users\Admin\AppData\Local\Temp\0ed051e7c5c9957a895e9bd0f388f03e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\svchoxt.exeC:\Windows\system32\\svchoxt.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:4348
-