Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 05:07
Behavioral task
behavioral1
Sample
42d4bec5123d8344e52b748e9baff342.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
42d4bec5123d8344e52b748e9baff342.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
42d4bec5123d8344e52b748e9baff342.exe
-
Size
11.7MB
-
MD5
42d4bec5123d8344e52b748e9baff342
-
SHA1
94a1e0d21d16eb2b92ec4b3a1d7b92c9489b1c33
-
SHA256
90b68e10d098d712f15fd6bc80d8daf607434d3e81e6f6d7085b4559ebafab8c
-
SHA512
57e44988c4324f571cba1cf3359c0629d84f3e1fdc40b9d3cb959540fc0b0a5e3b0dd1d96b7b1ac55f7d4055ab3e742c53f348a36052c7204fddbada054a77fa
-
SSDEEP
196608:f3sWugl/iBiPftLIagl/iBiPaXgbOgl/iBiPftLIagl/iBiP:vsR2iw5Ia2ifX92iw5Ia2i
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3048 42d4bec5123d8344e52b748e9baff342.exe -
Executes dropped EXE 1 IoCs
pid Process 3048 42d4bec5123d8344e52b748e9baff342.exe -
Loads dropped DLL 1 IoCs
pid Process 1272 42d4bec5123d8344e52b748e9baff342.exe -
resource yara_rule behavioral1/memory/1272-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1272 42d4bec5123d8344e52b748e9baff342.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1272 42d4bec5123d8344e52b748e9baff342.exe 3048 42d4bec5123d8344e52b748e9baff342.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1272 wrote to memory of 3048 1272 42d4bec5123d8344e52b748e9baff342.exe 18 PID 1272 wrote to memory of 3048 1272 42d4bec5123d8344e52b748e9baff342.exe 18 PID 1272 wrote to memory of 3048 1272 42d4bec5123d8344e52b748e9baff342.exe 18 PID 1272 wrote to memory of 3048 1272 42d4bec5123d8344e52b748e9baff342.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d4bec5123d8344e52b748e9baff342.exe"C:\Users\Admin\AppData\Local\Temp\42d4bec5123d8344e52b748e9baff342.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\42d4bec5123d8344e52b748e9baff342.exeC:\Users\Admin\AppData\Local\Temp\42d4bec5123d8344e52b748e9baff342.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3048
-