Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
02/01/2024, 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3ea29fe6207b21b8008d73582b5dc7b8.exe
Resource
win7-20231129-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3ea29fe6207b21b8008d73582b5dc7b8.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
3ea29fe6207b21b8008d73582b5dc7b8.exe
-
Size
82KB
-
MD5
3ea29fe6207b21b8008d73582b5dc7b8
-
SHA1
40f191847cbf5b398a464dec9fbc43baafc339ef
-
SHA256
0b5531597bf7a7388872df9edbfbc99d47ab24e9e9622615b74ad577d1f1c3e8
-
SHA512
f7f74ebc6e02150f6c835069665b2d3ed9ae47c99e8e36c397954a0faef80e2f3068076f61fbada3db3d2678cb2e76656bb1c33d8945de7fea999e587413350b
-
SSDEEP
1536:ciG16tFzwPb2SBlt8188hbmcR25dH4CQ3axzSgdnLRXGKe4xmwV0q0GYG:cX6tFD08q8hPQ5ZQKxmgdndWpev0Gz
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2976 3ea29fe6207b21b8008d73582b5dc7b8.exe -
Executes dropped EXE 1 IoCs
pid Process 2976 3ea29fe6207b21b8008d73582b5dc7b8.exe -
Loads dropped DLL 1 IoCs
pid Process 1960 3ea29fe6207b21b8008d73582b5dc7b8.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1960 3ea29fe6207b21b8008d73582b5dc7b8.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1960 3ea29fe6207b21b8008d73582b5dc7b8.exe 2976 3ea29fe6207b21b8008d73582b5dc7b8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2976 1960 3ea29fe6207b21b8008d73582b5dc7b8.exe 14 PID 1960 wrote to memory of 2976 1960 3ea29fe6207b21b8008d73582b5dc7b8.exe 14 PID 1960 wrote to memory of 2976 1960 3ea29fe6207b21b8008d73582b5dc7b8.exe 14 PID 1960 wrote to memory of 2976 1960 3ea29fe6207b21b8008d73582b5dc7b8.exe 14
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ea29fe6207b21b8008d73582b5dc7b8.exeC:\Users\Admin\AppData\Local\Temp\3ea29fe6207b21b8008d73582b5dc7b8.exe1⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2976
-
C:\Users\Admin\AppData\Local\Temp\3ea29fe6207b21b8008d73582b5dc7b8.exe"C:\Users\Admin\AppData\Local\Temp\3ea29fe6207b21b8008d73582b5dc7b8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1960