Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
22s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:30
Static task
static1
Behavioral task
behavioral1
Sample
26729162a6fd653f36527925d6a82e0d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
26729162a6fd653f36527925d6a82e0d.exe
Resource
win10v2004-20231222-en
General
-
Target
26729162a6fd653f36527925d6a82e0d.exe
-
Size
232KB
-
MD5
26729162a6fd653f36527925d6a82e0d
-
SHA1
c3a1c0a019769fb108386a398b6e7cb704b5568a
-
SHA256
4af602336dd43bdb01d339ad9947973160d5a9834f9187735f0df7bd10a86311
-
SHA512
f488d62d3ddfa808575d85db1fc59fa41cebc21444da3f63988cf520822dd31cad130bb2d3333c4849939a20b777a22672b118342251ab1beb6a14d3f42be7ac
-
SSDEEP
3072:PcVMMF0vWLj88tE/I4iGvKnO/aIsCCKVX89UKOpOhgSbmao5eEPQAwHcTxY0x:E7FWWHtKI4iGvOKaXZLypWzyPQAhTiK
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\New Windows\Allow 26729162a6fd653f36527925d6a82e0d.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\New Windows\Allow\*.wizpop.co.kr 26729162a6fd653f36527925d6a82e0d.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2760 26729162a6fd653f36527925d6a82e0d.exe 2760 26729162a6fd653f36527925d6a82e0d.exe 2760 26729162a6fd653f36527925d6a82e0d.exe 2760 26729162a6fd653f36527925d6a82e0d.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2928 2760 26729162a6fd653f36527925d6a82e0d.exe 18 PID 2760 wrote to memory of 2928 2760 26729162a6fd653f36527925d6a82e0d.exe 18 PID 2760 wrote to memory of 2928 2760 26729162a6fd653f36527925d6a82e0d.exe 18 PID 2760 wrote to memory of 2928 2760 26729162a6fd653f36527925d6a82e0d.exe 18 PID 2760 wrote to memory of 2928 2760 26729162a6fd653f36527925d6a82e0d.exe 18 PID 2760 wrote to memory of 2928 2760 26729162a6fd653f36527925d6a82e0d.exe 18 PID 2760 wrote to memory of 2928 2760 26729162a6fd653f36527925d6a82e0d.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\26729162a6fd653f36527925d6a82e0d.exe"C:\Users\Admin\AppData\Local\Temp\26729162a6fd653f36527925d6a82e0d.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\WizPop\WizPop_Helper.dll"2⤵PID:2928
-