Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
237e3cf9f73108ae0b3a97c4270d9acb.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
237e3cf9f73108ae0b3a97c4270d9acb.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
237e3cf9f73108ae0b3a97c4270d9acb.exe
-
Size
115KB
-
MD5
237e3cf9f73108ae0b3a97c4270d9acb
-
SHA1
c9565d3017a589bf2c70939b469c9a783ae3dbde
-
SHA256
cf232bd08938298920949002a6ba6b206ada3122f29740964b8bad285b15be1c
-
SHA512
3adb15254745a45b7ab43d4cd38712f8d1cb6aec4974afcf7d17a9c3566e2bc12509c7e13392ea6374c4dd063b43db98c756fce2de6cb0795d4528ef75b4e53e
-
SSDEEP
3072:R7DBfijNw+oxsbh6mjmt+R7Cl6UKe8h7ep:KFo8/Sg5Hhip
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2776-11-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/2776-9-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/2776-6-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/2776-4-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 816 set thread context of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 -
Program crash 1 IoCs
pid pid_target Process procid_target 2192 2776 WerFault.exe 20 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 816 237e3cf9f73108ae0b3a97c4270d9acb.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 816 wrote to memory of 2776 816 237e3cf9f73108ae0b3a97c4270d9acb.exe 20 PID 2776 wrote to memory of 2192 2776 237e3cf9f73108ae0b3a97c4270d9acb.exe 21 PID 2776 wrote to memory of 2192 2776 237e3cf9f73108ae0b3a97c4270d9acb.exe 21 PID 2776 wrote to memory of 2192 2776 237e3cf9f73108ae0b3a97c4270d9acb.exe 21 PID 2776 wrote to memory of 2192 2776 237e3cf9f73108ae0b3a97c4270d9acb.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\237e3cf9f73108ae0b3a97c4270d9acb.exe"C:\Users\Admin\AppData\Local\Temp\237e3cf9f73108ae0b3a97c4270d9acb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\237e3cf9f73108ae0b3a97c4270d9acb.exe
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 883⤵
- Program crash
PID:2192
-
-