Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 19:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5cbedfc8cb4b91ed6b70b40d4489e9ed.exe
Resource
win7-20231215-en
3 signatures
150 seconds
General
-
Target
5cbedfc8cb4b91ed6b70b40d4489e9ed.exe
-
Size
1.1MB
-
MD5
5cbedfc8cb4b91ed6b70b40d4489e9ed
-
SHA1
b56421265081dbad0a815533bd1aedfe630f8e7c
-
SHA256
30d0f0e3bc0bb25448c58097cb620fab4bf9bf3831fa1c38420bf3fc777c1e31
-
SHA512
14c9eddd99854291740300cf7f819899f9b32903a69e196be00c1eab4fc448a20f9e86a31428ae6af4cfba8007bc143a805e2a08aaad79926fa0e04712e39d0e
-
SSDEEP
24576:oU9W4FjII16gEZL23Y6ld/zW7epoNr2t7twQuiyIakELXBqLIek9Jhpfn:f9WyIUREU3lld/zW7E+K/lrL8XBqLIJf
Malware Config
Extracted
Family
risepro
C2
193.233.132.62:50500
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2152 5cbedfc8cb4b91ed6b70b40d4489e9ed.exe