Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
78cdea964533f506302f5bc4692c031a.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
78cdea964533f506302f5bc4692c031a.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
78cdea964533f506302f5bc4692c031a.exe
-
Size
403KB
-
MD5
78cdea964533f506302f5bc4692c031a
-
SHA1
032185fada79a383200dd7be2149c1bad85e32fe
-
SHA256
b70d69aaeac1b23d9e35713390032c51949b9678ca2bb77fff64d001f2b7b789
-
SHA512
425714a8c11bf6f9fd0575dbd792b0c9eed0c4d616c0f2fec046c38e2107e8cf9d4621fec7d3d4d2bf5110625bef7c9859736d49d8f0149511221fa41f743ad3
-
SSDEEP
12288:cgenlEL0LHs2+teXx/z3WC4/1KI2KKFg1dIvyGOs4G:jL0LHlqIxb3W39MHFuOvyS
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2444-1-0x0000000000400000-0x00000000004CC000-memory.dmp upx behavioral1/memory/2444-77-0x0000000000400000-0x00000000004CC000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\78cdea964533f506302f5bc4692c031a = "C:\\ProgramData\\*" 78cdea964533f506302f5bc4692c031a.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\78cdea964533f506302f5bc4692c031a = "C:\\Users\\Admin\\AppData\\Local\\Temp\\78cdea964533f506302f5bc4692c031a.exe" 78cdea964533f506302f5bc4692c031a.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main 78cdea964533f506302f5bc4692c031a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2444 78cdea964533f506302f5bc4692c031a.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2444 78cdea964533f506302f5bc4692c031a.exe 2444 78cdea964533f506302f5bc4692c031a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78cdea964533f506302f5bc4692c031a.exe"C:\Users\Admin\AppData\Local\Temp\78cdea964533f506302f5bc4692c031a.exe"1⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2444