Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
794d973af7d463d579cb1e663fe1949b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
794d973af7d463d579cb1e663fe1949b.exe
Resource
win10v2004-20231215-en
General
-
Target
794d973af7d463d579cb1e663fe1949b.exe
-
Size
193KB
-
MD5
794d973af7d463d579cb1e663fe1949b
-
SHA1
9b6e82d09e998804b68d894142ccbd7d79a9ac54
-
SHA256
b2b1005cf34c20e9799da3d1d0c48e68a0cfe14c27545156a10c8b6305a289c2
-
SHA512
b4b0acff9189c0db9c130487ccb796154c510f74862f1b493593499e1aa2bd845f0a7e207b006ed7c1c6af9cae7b27e43bcdbb0d0ef2c03bd53a5d794c657bfd
-
SSDEEP
3072:SOrXxb6jasztQBE7G1mNm8395ucDQOnY0hRQ0LGMDbQ+45KWTgh3aVZjT1:SOrXx2asKE7G149ND5YBU5DbZWMujh
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1088 svchost.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dxdiag.exe svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2008 794d973af7d463d579cb1e663fe1949b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1088 2008 794d973af7d463d579cb1e663fe1949b.exe 28 PID 2008 wrote to memory of 1088 2008 794d973af7d463d579cb1e663fe1949b.exe 28 PID 2008 wrote to memory of 1088 2008 794d973af7d463d579cb1e663fe1949b.exe 28 PID 2008 wrote to memory of 1088 2008 794d973af7d463d579cb1e663fe1949b.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\794d973af7d463d579cb1e663fe1949b.exe"C:\Users\Admin\AppData\Local\Temp\794d973af7d463d579cb1e663fe1949b.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
- Drops startup file
PID:1088
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
193KB
MD5794d973af7d463d579cb1e663fe1949b
SHA19b6e82d09e998804b68d894142ccbd7d79a9ac54
SHA256b2b1005cf34c20e9799da3d1d0c48e68a0cfe14c27545156a10c8b6305a289c2
SHA512b4b0acff9189c0db9c130487ccb796154c510f74862f1b493593499e1aa2bd845f0a7e207b006ed7c1c6af9cae7b27e43bcdbb0d0ef2c03bd53a5d794c657bfd