Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/01/2024, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
5b22bd0d6fb4ca2e92b1a2a283d4af90.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5b22bd0d6fb4ca2e92b1a2a283d4af90.exe
Resource
win10v2004-20231222-en
General
-
Target
5b22bd0d6fb4ca2e92b1a2a283d4af90.exe
-
Size
3.3MB
-
MD5
5b22bd0d6fb4ca2e92b1a2a283d4af90
-
SHA1
930f9e476aea45d44fe84d6b33a2752b67ae1cb4
-
SHA256
b3a6f40bd2accf9e1e2f96783d6933c8265cdf4e06555e2fdee570ce88789949
-
SHA512
b66180e304fd219643f76f4cdfd767c11bbc7e50f9a7cc3db99d946afb72c0a83a9d4ed1bc694a397bb368db18cb900015d670b2b0fa3bfe675d16c25941c059
-
SSDEEP
98304:K/YDZAZocXqTJ8WU9eslmiHNPY/Jef3pcIqwofxJJlQ2qx+7C6:gYdAZHXE8WU9JllHDhVofT0YZ
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Wapp = "C:\\Arquivos de programas\\Wapp.exe" 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Menu Iniciar\Iniciar\Wapp.exe 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe File created C:\WINDOWS\system\Logfile.txt 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2040 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1760 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1760 wrote to memory of 2040 1760 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe 19 PID 1760 wrote to memory of 2040 1760 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe 19 PID 1760 wrote to memory of 2040 1760 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe 19 PID 1760 wrote to memory of 2040 1760 5b22bd0d6fb4ca2e92b1a2a283d4af90.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b22bd0d6fb4ca2e92b1a2a283d4af90.exe"C:\Users\Admin\AppData\Local\Temp\5b22bd0d6fb4ca2e92b1a2a283d4af90.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
PID:2040
-