Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 12:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1868c5675ebf74e1ef2e4bc18ae33a13.exe
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1868c5675ebf74e1ef2e4bc18ae33a13.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
1868c5675ebf74e1ef2e4bc18ae33a13.exe
-
Size
51KB
-
MD5
1868c5675ebf74e1ef2e4bc18ae33a13
-
SHA1
ee317e72e1489e3a9c2a0d58893d9287d56b1340
-
SHA256
e6d2b0128f06192646cbf1c17d6e80811cf315d174f6326b64464b5225e14d40
-
SHA512
9db04912072aa9f098beefaea76d4231b5c234224c45a38e878541e18c78f4e4ce20702645ba0771cd9cbe247954b6b9de775ed51a72e3c9767d2253cfdd02b9
-
SSDEEP
1536:exzvchUA/yLZBAnyn7guwK+H+p1jITXdD0:e1cB/yMnynV+H+p1UjdD0
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\ntos.exe," 1868c5675ebf74e1ef2e4bc18ae33a13.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 1868c5675ebf74e1ef2e4bc18ae33a13.exe File created C:\Windows\SysWOW64\ntos.exe 1868c5675ebf74e1ef2e4bc18ae33a13.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2820 1868c5675ebf74e1ef2e4bc18ae33a13.exe 2820 1868c5675ebf74e1ef2e4bc18ae33a13.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2820 1868c5675ebf74e1ef2e4bc18ae33a13.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1868c5675ebf74e1ef2e4bc18ae33a13.exe"C:\Users\Admin\AppData\Local\Temp\1868c5675ebf74e1ef2e4bc18ae33a13.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820