Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

7eccd6ceaa...40.exe

windows7-x64

7

7eccd6ceaa...40.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    0s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 07:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7eccd6ceaafd1116f22a016865986a865b7b8bddf73dcebb78a5afb2955f7d40.exe

  • Size

    1.1MB

  • MD5

    cb25fe91eb74ccafaafe0f78ccb7333a

  • SHA1

    7a5cb10bd068811941c881a031fd1e53610a46ba

  • SHA256

    7eccd6ceaafd1116f22a016865986a865b7b8bddf73dcebb78a5afb2955f7d40

  • SHA512

    75d138a2760be0ea521965a7bac1c79358e64c968f79086b6c2960a29412fabdc2846d0f1b612230c99eaa5e403a06292f92e23340bf510bbff5ac978db15dbd

  • SSDEEP

    24576:gRW3N/0f/oAPoRBchI5anfOlAUAi1K6oElG4lBujFAvCyRI:g5ApamAUAQ/lG4lBmFAvZI

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7eccd6ceaafd1116f22a016865986a865b7b8bddf73dcebb78a5afb2955f7d40.exe
    "C:\Users\Admin\AppData\Local\Temp\7eccd6ceaafd1116f22a016865986a865b7b8bddf73dcebb78a5afb2955f7d40.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:2720
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
      2⤵
        PID:2072
        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
          3⤵
            PID:1796
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
              4⤵
                PID:3772
                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                  5⤵
                    PID:4532
                    • C:\Windows\SysWOW64\WScript.exe
                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                      6⤵
                        PID:4816
                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                          7⤵
                            PID:2844
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                              8⤵
                                PID:2816
                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                  9⤵
                                    PID:4828
                                    • C:\Windows\SysWOW64\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                      10⤵
                                        PID:1560
                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                          11⤵
                                            PID:2120
                                            • C:\Windows\SysWOW64\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                              12⤵
                                                PID:3608
                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                  13⤵
                                                    PID:3204
                                                    • C:\Windows\SysWOW64\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                      14⤵
                                                        PID:2460
                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                          15⤵
                                                            PID:4968
                                                            • C:\Windows\SysWOW64\WScript.exe
                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                              16⤵
                                                                PID:468
                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                  17⤵
                                                                    PID:4132
                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                      18⤵
                                                                        PID:1408
                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                          19⤵
                                                                            PID:1676
                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                              20⤵
                                                                                PID:1036
                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                  21⤵
                                                                                    PID:2132
                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                      22⤵
                                                                                        PID:2072
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                          23⤵
                                                                                            PID:3316
                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                              24⤵
                                                                                                PID:3424
                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                  25⤵
                                                                                                    PID:3080
                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                      26⤵
                                                                                                        PID:1388
                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                          27⤵
                                                                                                            PID:3872
                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                              28⤵
                                                                                                                PID:760
                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                  29⤵
                                                                                                                    PID:712
                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                      30⤵
                                                                                                                        PID:1528
                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                          31⤵
                                                                                                                            PID:324
                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                              32⤵
                                                                                                                                PID:936
                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                  33⤵
                                                                                                                                    PID:4544
                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                      34⤵
                                                                                                                                        PID:2316
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                          35⤵
                                                                                                                                            PID:4244
                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                              36⤵
                                                                                                                                                PID:876
                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                                  37⤵
                                                                                                                                                    PID:3096
                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                                      38⤵
                                                                                                                                                        PID:3820
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                                          39⤵
                                                                                                                                                            PID:4364
                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                                              40⤵
                                                                                                                                                                PID:1872
                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                                                  41⤵
                                                                                                                                                                    PID:1544
                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                                                      42⤵
                                                                                                                                                                        PID:1876
                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                                                          43⤵
                                                                                                                                                                            PID:3528
                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                                                              44⤵
                                                                                                                                                                                PID:1684
                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                                                                  45⤵
                                                                                                                                                                                    PID:2692
                                                                                                                                                                                    • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                                                                      46⤵
                                                                                                                                                                                        PID:1372
                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\Microsoft\svchcst.exe"
                                                                                                                                                                                          47⤵
                                                                                                                                                                                            PID:3676
                                                                                                                                                                                            • C:\Windows\SysWOW64\WScript.exe
                                                                                                                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"
                                                                                                                                                                                              48⤵
                                                                                                                                                                                                PID:3280

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs
                                                                                                  Filesize

                                                                                                  753B

                                                                                                  MD5

                                                                                                  0a482b2089caf62be6a8b5c9d05159e1

                                                                                                  SHA1

                                                                                                  8fefc0f18baf11136a6d2844c3053f2d93841be8

                                                                                                  SHA256

                                                                                                  9c84c9a5815362c85d9dd843250311b4be4e2ed0f15d972da5248319eac4f61d

                                                                                                  SHA512

                                                                                                  903a483fa3cbfcbb0c581bbff2d8a30da97f7ba0afeaf097244696d47919cd6d0f2af471d47abd6767f6c2ff6258d74c9b49e00fbe566748bf41fceab77bcf31

                                                                                                  Download Submit