Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/01/2024, 15:18
Behavioral task
behavioral1
Sample
3e4e40b41f48343127e42acae940ce77.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
3e4e40b41f48343127e42acae940ce77.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
3e4e40b41f48343127e42acae940ce77.exe
-
Size
1.3MB
-
MD5
3e4e40b41f48343127e42acae940ce77
-
SHA1
dbdf134c9f76002296c772b6cc9fb6c7a398bfdf
-
SHA256
062cedc75a29729108da4f20097472ab15a2cef49bd5c1630285604c01abf1a4
-
SHA512
f5617b575797efe90a9298142fd1141e5b4ff59e74c37dcb74614c107a8f012d9cf4d45a0dd9982921429f58315a255f42125cb769c90fab2a6b8b0bcff0d703
-
SSDEEP
24576:ajHEI/lgl8fXVpA2rkzTxXXNgTJ1rHztW/pICPIJA2geOw0jgHnKtWO:ajkI/Kl67A2rmXXNg91rTE/p9PIJA2PW
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2352 3e4e40b41f48343127e42acae940ce77.exe -
Executes dropped EXE 1 IoCs
pid Process 2352 3e4e40b41f48343127e42acae940ce77.exe -
Loads dropped DLL 1 IoCs
pid Process 1424 3e4e40b41f48343127e42acae940ce77.exe -
resource yara_rule behavioral1/memory/1424-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral1/memory/1424-15-0x0000000003650000-0x0000000003B3F000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1424 3e4e40b41f48343127e42acae940ce77.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1424 3e4e40b41f48343127e42acae940ce77.exe 2352 3e4e40b41f48343127e42acae940ce77.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2352 1424 3e4e40b41f48343127e42acae940ce77.exe 17 PID 1424 wrote to memory of 2352 1424 3e4e40b41f48343127e42acae940ce77.exe 17 PID 1424 wrote to memory of 2352 1424 3e4e40b41f48343127e42acae940ce77.exe 17 PID 1424 wrote to memory of 2352 1424 3e4e40b41f48343127e42acae940ce77.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e4e40b41f48343127e42acae940ce77.exe"C:\Users\Admin\AppData\Local\Temp\3e4e40b41f48343127e42acae940ce77.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3e4e40b41f48343127e42acae940ce77.exeC:\Users\Admin\AppData\Local\Temp\3e4e40b41f48343127e42acae940ce77.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2352
-