Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:58
Behavioral task
behavioral1
Sample
12cecd00181724148ea8fd1dd6c3ef7c.exe
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
12cecd00181724148ea8fd1dd6c3ef7c.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
12cecd00181724148ea8fd1dd6c3ef7c.exe
-
Size
955KB
-
MD5
12cecd00181724148ea8fd1dd6c3ef7c
-
SHA1
3d27bdce20ccbd794b57fb17ba5e9efb57dada92
-
SHA256
19d0f249e30903f9eafbb9de80f9ea52dc0a16f93339c0ee99a397230b2b8189
-
SHA512
9911a90e892b8181b6eefa4c765a57b76c6574e718f4df375d4e85f929f943ce75cdafa439f143b07e77b263ede7a4b5855e4e5d79b00320e81aa8331d4d01a7
-
SSDEEP
12288:rbpHYUKy5U1bo9t8DMRSW9vbciUiLuAvOxMt11i27QitjI:r5sJo6YrFUiyAak11LtjI
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2752 svchest000.exe -
resource yara_rule behavioral1/memory/3008-0-0x0000000000400000-0x0000000000597000-memory.dmp upx behavioral1/memory/3008-1-0x0000000000400000-0x0000000000597000-memory.dmp upx behavioral1/memory/2752-13-0x0000000000400000-0x0000000000597000-memory.dmp upx behavioral1/memory/2752-10-0x0000000000400000-0x0000000000597000-memory.dmp upx behavioral1/memory/2752-9-0x0000000000400000-0x0000000000597000-memory.dmp upx behavioral1/memory/3008-14-0x0000000000400000-0x0000000000597000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kris = "C:\\Users\\Admin\\AppData\\Local\\Temp\\12cecd00181724148ea8fd1dd6c3ef7c.exe" 12cecd00181724148ea8fd1dd6c3ef7c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3008 12cecd00181724148ea8fd1dd6c3ef7c.exe 2752 svchest000.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\Windows\BJ.exe 12cecd00181724148ea8fd1dd6c3ef7c.exe File created \??\c:\Windows\BJ.exe 12cecd00181724148ea8fd1dd6c3ef7c.exe File created \??\c:\Windows\svchest000.exe 12cecd00181724148ea8fd1dd6c3ef7c.exe File opened for modification \??\c:\Windows\svchest000.exe 12cecd00181724148ea8fd1dd6c3ef7c.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2752 3008 12cecd00181724148ea8fd1dd6c3ef7c.exe 16 PID 3008 wrote to memory of 2752 3008 12cecd00181724148ea8fd1dd6c3ef7c.exe 16 PID 3008 wrote to memory of 2752 3008 12cecd00181724148ea8fd1dd6c3ef7c.exe 16 PID 3008 wrote to memory of 2752 3008 12cecd00181724148ea8fd1dd6c3ef7c.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\12cecd00181724148ea8fd1dd6c3ef7c.exe"C:\Users\Admin\AppData\Local\Temp\12cecd00181724148ea8fd1dd6c3ef7c.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\Windows\svchest000.exec:\Windows\svchest000.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2752
-