Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
2c4abccdb34478c65e2c5ecfac27cdf9.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c4abccdb34478c65e2c5ecfac27cdf9.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
2c4abccdb34478c65e2c5ecfac27cdf9.exe
-
Size
1.3MB
-
MD5
2c4abccdb34478c65e2c5ecfac27cdf9
-
SHA1
1ec173798f7dcd352d0de28377c0e8f78accc001
-
SHA256
0535904cd4dcec70c3eddee5dffffee3fcd18d4af25f0e1e4a59fbea60a30df5
-
SHA512
9fec2b8e5967392e52335391217c930af777a719b9f3977835d1e0a1c88775b20b85b79bc2c21e6efadf4f9bf7cd35af21a934066f3cb9e4409e1e606ebbc839
-
SSDEEP
12288:5NcHEbpY4gs4BxjkN2ieWfYgKZ3F8FDZaxSCWKarX73HY04RzbcMQbgnivA9yDEy:sqIB+JSZ3FuZMGrU0IzoMn4AADw49J
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2216 set thread context of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main 2c4abccdb34478c65e2c5ecfac27cdf9.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3028 2c4abccdb34478c65e2c5ecfac27cdf9.exe 3028 2c4abccdb34478c65e2c5ecfac27cdf9.exe 3028 2c4abccdb34478c65e2c5ecfac27cdf9.exe 3028 2c4abccdb34478c65e2c5ecfac27cdf9.exe 3028 2c4abccdb34478c65e2c5ecfac27cdf9.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27 PID 2216 wrote to memory of 3028 2216 2c4abccdb34478c65e2c5ecfac27cdf9.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c4abccdb34478c65e2c5ecfac27cdf9.exe"C:\Users\Admin\AppData\Local\Temp\2c4abccdb34478c65e2c5ecfac27cdf9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\2c4abccdb34478c65e2c5ecfac27cdf9.exe
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3028
-