Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:48
Static task
static1
Behavioral task
behavioral1
Sample
Office 2010 Toolkit & EZ-Activator 2.0 Beta 3/Office 2010 Toolkit.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Office 2010 Toolkit & EZ-Activator 2.0 Beta 3/Office 2010 Toolkit.exe
Resource
win10v2004-20231215-en
General
-
Target
Office 2010 Toolkit & EZ-Activator 2.0 Beta 3/Office 2010 Toolkit.exe
-
Size
13.3MB
-
MD5
801d7f317b7a067295bf4f8ea9dbf75f
-
SHA1
d548ab079b6f7e119cb48ca614fb2e0ca9989fb5
-
SHA256
3eb696008de29b3491c82e8c69b8382a7cb296a974a803b1f615f1d005b3be39
-
SHA512
f737f0a8b1992650fb3d2965c57c1b36fee0920fae4d6f7ff156dee870cd0ff173ebfafd2f2fa18f2d4c179a7fa73ca88eaf9754f0a1c2f7a32dfaae935d1066
-
SSDEEP
49152:HVDqgb7NC49ZD/SX1UFqQmNeLa1o3kYQHjOCAJ/Lsb63lqZGNml0Hgq30XhWpd:1D1DSN2UxAJDh3F
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2172 1048 Office 2010 Toolkit.exe 31 PID 1048 wrote to memory of 2172 1048 Office 2010 Toolkit.exe 31 PID 1048 wrote to memory of 2172 1048 Office 2010 Toolkit.exe 31 PID 2172 wrote to memory of 2288 2172 cmd.exe 29 PID 2172 wrote to memory of 2288 2172 cmd.exe 29 PID 2172 wrote to memory of 2288 2172 cmd.exe 29 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Office 2010 Toolkit & EZ-Activator 2.0 Beta 3\Office 2010 Toolkit.exe"C:\Users\Admin\AppData\Local\Temp\Office 2010 Toolkit & EZ-Activator 2.0 Beta 3\Office 2010 Toolkit.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\system32\cmd.exe"cmd.exe" /C schtasks /query /TN "AutoKMS"2⤵
- Suspicious use of WriteProcessMemory
PID:2172
-
-
C:\Windows\system32\schtasks.exeschtasks /query /TN "AutoKMS"1⤵PID:2288