Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65a7b20cf373dd4e6cf8eaaa50b5de65.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
65a7b20cf373dd4e6cf8eaaa50b5de65.exe
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
65a7b20cf373dd4e6cf8eaaa50b5de65.exe
-
Size
39KB
-
MD5
65a7b20cf373dd4e6cf8eaaa50b5de65
-
SHA1
4b232888f028b6887b4c6c8ac957160638a51d95
-
SHA256
bbb4b3d3d717b5ab719f2056dd52f9a081d5ab269aca8d2d182634932aac8ee1
-
SHA512
00ee66579f5fa943f32db51175a01c478f1282479c210d689258250481638912180d13913d9b71a52269782d9e6b876c0ae957b33b3720f32a99dc4715881ac0
-
SSDEEP
768:pAh0wTSECfXJ879YIb0CvcchZqTEz2n27YT8tq:qvkBySRCvmYzmDT8tq
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2000 set thread context of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2600 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 2600 65a7b20cf373dd4e6cf8eaaa50b5de65.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 PID 2000 wrote to memory of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 PID 2000 wrote to memory of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 PID 2000 wrote to memory of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 PID 2000 wrote to memory of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 PID 2000 wrote to memory of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 PID 2000 wrote to memory of 2600 2000 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 28 PID 2600 wrote to memory of 1308 2600 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 17 PID 2600 wrote to memory of 1308 2600 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 17 PID 2600 wrote to memory of 1308 2600 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 17 PID 2600 wrote to memory of 1308 2600 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 17
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exe"C:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exeêC:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600
-
-