Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 15:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d2fd5d2f5f40ded6f7862e292c4f0b7.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3d2fd5d2f5f40ded6f7862e292c4f0b7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
3d2fd5d2f5f40ded6f7862e292c4f0b7.exe
-
Size
183KB
-
MD5
3d2fd5d2f5f40ded6f7862e292c4f0b7
-
SHA1
b0f49e9f767f9ab49858274c25adbba8d5cd0631
-
SHA256
394dea564eda85365e036a7bdea5b955791088b6ef83e21a34ba5eb8bb0efef7
-
SHA512
92bd27b0b90b55dc365bd76db1c721e45010c38f070211fa140d05330d22c6fe444df580fa336d3aa9fca5426de241b2832ca9c83d0e14572fde1fc3fee6fbe7
-
SSDEEP
3072:hhHE7rc7bPIaHHqAfRtk969a+b8Pn33oDCjNozgCDNlcUtpxXPpIrCNSqSF/:rHE7KIeqA5m89heoDGNozZRlLtptKrOE
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3012 services.exe -
Loads dropped DLL 1 IoCs
pid Process 3012 services.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\360.dll 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\WINDOWS\services.exe 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe File opened for modification C:\WINDOWS\services.exe 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell\open services.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell\open\command services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\Shell\open\command\ = "C:\\WINDOWS\\services.exe 360,bmp" services.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2996 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe 3012 services.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2996 wrote to memory of 3012 2996 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 28 PID 2996 wrote to memory of 3012 2996 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 28 PID 2996 wrote to memory of 3012 2996 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 28 PID 2996 wrote to memory of 3012 2996 3d2fd5d2f5f40ded6f7862e292c4f0b7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d2fd5d2f5f40ded6f7862e292c4f0b7.exe"C:\Users\Admin\AppData\Local\Temp\3d2fd5d2f5f40ded6f7862e292c4f0b7.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\WINDOWS\services.exeC:\WINDOWS\services.exe 360,bmp2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3012
-