Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 21:10
Behavioral task
behavioral1
Sample
1c8df31fbe978c80a4153bf4d64a5ae3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1c8df31fbe978c80a4153bf4d64a5ae3.exe
Resource
win10v2004-20231215-en
General
-
Target
1c8df31fbe978c80a4153bf4d64a5ae3.exe
-
Size
150KB
-
MD5
1c8df31fbe978c80a4153bf4d64a5ae3
-
SHA1
fafd0c366d66887100a5dedc632eeca562291fec
-
SHA256
8ce6596014ad3109ed670be2f277c61b5bd31ad2246b2e21ebbda65cf4b83784
-
SHA512
b5176b2caa4b5b2d78443068330051710d49627d7da5abc9bfea9dd4e2781740f744bf6edbbe685dbfbef4e13e3de3a880d0717e89ace1a37ff48759b6be26b9
-
SSDEEP
3072:k+dz72JzuobBYnYpBS4/33mMQuoGRXSflUUkFOScvG6z/K:xBCIobBr3nrnRXACFXh6z
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1c8df31fbe978c80a4153bf4d64a5ae3.exe -
resource yara_rule behavioral1/memory/1304-0-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1304 set thread context of 2128 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2144 2128 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1304 wrote to memory of 2128 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe 28 PID 1304 wrote to memory of 2128 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe 28 PID 1304 wrote to memory of 2128 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe 28 PID 1304 wrote to memory of 2128 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe 28 PID 1304 wrote to memory of 2128 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe 28 PID 1304 wrote to memory of 2128 1304 1c8df31fbe978c80a4153bf4d64a5ae3.exe 28 PID 2128 wrote to memory of 2144 2128 svchost.exe 29 PID 2128 wrote to memory of 2144 2128 svchost.exe 29 PID 2128 wrote to memory of 2144 2128 svchost.exe 29 PID 2128 wrote to memory of 2144 2128 svchost.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c8df31fbe978c80a4153bf4d64a5ae3.exe"C:\Users\Admin\AppData\Local\Temp\1c8df31fbe978c80a4153bf4d64a5ae3.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 1563⤵
- Program crash
PID:2144
-
-