Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 06:32
Behavioral task
behavioral1
Sample
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe
Resource
win10v2004-20231215-en
General
-
Target
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe
-
Size
9.3MB
-
MD5
0b03a3114d284addb6ee45238a85b578
-
SHA1
fa1cecbfaf5484daf760a13a5efc4ec5ebdb1fc2
-
SHA256
ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a
-
SHA512
7501a7ca433a216a78d270c1a7d66d812e2c20dbd12abbb85b0189fdde74f131d1c4cfa0b6d3e04e4083b5105f003f7e578f5abca8dd4982d2114db739371016
-
SSDEEP
196608:UC45CtVx/sDUPoYPHMQWt9HSqaLOX+RJ21j7ukYEVpy:b45Wj/BPxHjWt90O821e+V
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2264-0-0x0000000000400000-0x000000000173C000-memory.dmp vmprotect behavioral1/memory/2264-6-0x0000000000400000-0x000000000173C000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2264 ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2264 ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2264 ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe 2264 ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe"C:\Users\Admin\AppData\Local\Temp\ae8c223d38c19bcc3154aad223c6f8fa7401119dfba8f185162541fe68b47e2a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2264 -
C:\Windows\empty.exeC:\Windows\empty.exe 22642⤵PID:2528
-
-
C:\Windows\empty.exeC:\Windows\empty.exe 22642⤵PID:2816
-
-
C:\Windows\empty.exeC:\Windows\empty.exe 22642⤵PID:2548
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5523d5c39f9d8d2375c3df68251fa2249
SHA1d4ed365c44bec9246fc1a65a32a7791792647a10
SHA25620e3dc90a3e83b6202e2a7f4603b60e5e859639cb68693426c400b13aaeabd78
SHA512526e1bba30d03f1ac177c6ab7409187a730969c429cebef15da68ffcf44b3b93227781eebc827b2f7a0fa17c391e00a0e532263fd0167aeaeb0456f96cfe3ae4