Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
4fd364e00a98ce49205043cbbd2bee31.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4fd364e00a98ce49205043cbbd2bee31.exe
Resource
win10v2004-20231215-en
General
-
Target
4fd364e00a98ce49205043cbbd2bee31.exe
-
Size
38KB
-
MD5
4fd364e00a98ce49205043cbbd2bee31
-
SHA1
804ebbf125de01ad6651d81973bc8950aac38076
-
SHA256
630a9b9da20ebbcbf5f48c97050a965927ae7e6fa306f1f3b932f8d9e3e2354b
-
SHA512
b92e837ad017c014a2bdc3828ef2af23e77eeaeb44abe3c5edc5bacc65e4eebd6ddbcfa0d047038e5b86f5eb1b9683d0d7596ec9953a732c0762ad8ad4945d2e
-
SSDEEP
768:8vR1XXw9btkGXyT8L6qdaQAOCkliE3V3KJT6nbjq:O1wPiT8DkQAOCqrVKJTZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2808 winmgrs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control Center = "winmgrs.exe" 4fd364e00a98ce49205043cbbd2bee31.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1732 set thread context of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\winmgrs.exe 4fd364e00a98ce49205043cbbd2bee31.exe File opened for modification C:\Windows\winmgrs.exe 4fd364e00a98ce49205043cbbd2bee31.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2884 2808 WerFault.exe 17 -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1732 wrote to memory of 1888 1732 4fd364e00a98ce49205043cbbd2bee31.exe 16 PID 1888 wrote to memory of 2808 1888 4fd364e00a98ce49205043cbbd2bee31.exe 17 PID 1888 wrote to memory of 2808 1888 4fd364e00a98ce49205043cbbd2bee31.exe 17 PID 1888 wrote to memory of 2808 1888 4fd364e00a98ce49205043cbbd2bee31.exe 17 PID 1888 wrote to memory of 2808 1888 4fd364e00a98ce49205043cbbd2bee31.exe 17 PID 2808 wrote to memory of 2884 2808 winmgrs.exe 18 PID 2808 wrote to memory of 2884 2808 winmgrs.exe 18 PID 2808 wrote to memory of 2884 2808 winmgrs.exe 18 PID 2808 wrote to memory of 2884 2808 winmgrs.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fd364e00a98ce49205043cbbd2bee31.exeC:\Users\Admin\AppData\Local\Temp\4fd364e00a98ce49205043cbbd2bee31.exe1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\winmgrs.exe"C:\Windows\winmgrs.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 723⤵
- Program crash
PID:2884
-
-
-
C:\Users\Admin\AppData\Local\Temp\4fd364e00a98ce49205043cbbd2bee31.exe"C:\Users\Admin\AppData\Local\Temp\4fd364e00a98ce49205043cbbd2bee31.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD54fd364e00a98ce49205043cbbd2bee31
SHA1804ebbf125de01ad6651d81973bc8950aac38076
SHA256630a9b9da20ebbcbf5f48c97050a965927ae7e6fa306f1f3b932f8d9e3e2354b
SHA512b92e837ad017c014a2bdc3828ef2af23e77eeaeb44abe3c5edc5bacc65e4eebd6ddbcfa0d047038e5b86f5eb1b9683d0d7596ec9953a732c0762ad8ad4945d2e