Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
15c0c2ce25e4f02d026c60b6dc58b166.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
15c0c2ce25e4f02d026c60b6dc58b166.exe
Resource
win10v2004-20231215-en
General
-
Target
15c0c2ce25e4f02d026c60b6dc58b166.exe
-
Size
344KB
-
MD5
15c0c2ce25e4f02d026c60b6dc58b166
-
SHA1
2164a4b678d6bbc8a7948a623da40c42f3d10309
-
SHA256
4c5ae07738e2ddf31f25f1244551f1dfe36c571fa1b93470a3fd6befb1a57bb8
-
SHA512
5820add84401e41961d7e8ea33bb2c2b21be4894f242b3309e5825d319edbdc6683a9448f09f5091e210cd2e02e38e3025bcacb1a1dcae0136f234d825ca09bb
-
SSDEEP
3072:X99UZTQXyZYrG7mEKx/tnq3YuVFr3jW8v6fxVQYGXTBmANksb7c9Xtr3hvB99BFO:p8vExOjjVc9XtrtcIFW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1980 8DBF.tmp -
Loads dropped DLL 5 IoCs
pid Process 2748 15c0c2ce25e4f02d026c60b6dc58b166.exe 2748 15c0c2ce25e4f02d026c60b6dc58b166.exe 3004 WerFault.exe 3004 WerFault.exe 3004 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1888 set thread context of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 3004 1980 WerFault.exe 29 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 1888 wrote to memory of 2748 1888 15c0c2ce25e4f02d026c60b6dc58b166.exe 28 PID 2748 wrote to memory of 1980 2748 15c0c2ce25e4f02d026c60b6dc58b166.exe 29 PID 2748 wrote to memory of 1980 2748 15c0c2ce25e4f02d026c60b6dc58b166.exe 29 PID 2748 wrote to memory of 1980 2748 15c0c2ce25e4f02d026c60b6dc58b166.exe 29 PID 2748 wrote to memory of 1980 2748 15c0c2ce25e4f02d026c60b6dc58b166.exe 29 PID 1980 wrote to memory of 3004 1980 8DBF.tmp 30 PID 1980 wrote to memory of 3004 1980 8DBF.tmp 30 PID 1980 wrote to memory of 3004 1980 8DBF.tmp 30 PID 1980 wrote to memory of 3004 1980 8DBF.tmp 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exe"C:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exeC:\Users\Admin\AppData\Local\Temp\15c0c2ce25e4f02d026c60b6dc58b166.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmpC:\Users\Admin\AppData\Local\Temp\8DBF.tmp3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 364⤵
- Loads dropped DLL
- Program crash
PID:3004
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5d04159304832ed17c75a03f4aece0f46
SHA1d85f25676e11b2018f3f68c510664510756ed479
SHA2560470e393ee290cc352cee76cf7e1faa68aaf5bba0fc663c0f62093aa5ca2a0e4
SHA5120f2a6463fee783ef5bb828c547975d90e36b5b46a57b4fdccc47b5be30c5b01e6855023ca3bcf2026299b4c6979ce7fde361c1354ad8ae483a51662e5458f0f8