Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20231215-en
General
-
Target
file.exe
-
Size
4.5MB
-
MD5
059660095ba38842e176cf29d8adc954
-
SHA1
a330e477566fed2f46b19199853762fea089cec6
-
SHA256
0e0e02546f73e4914cd735dea83a94435e567a26d64c11b8a7fc6f0ef6fc4103
-
SHA512
26f21b1ebdb44e4b85a30a9b1ee86cf6b014563270f2a3b150aa997f27734835202fd1551c84683d3866e56dac81ccf9de189b96209cc7655320d0bea8a86684
-
SSDEEP
49152:zolGmH4YG9aEZv9zPpYpuPKlMVNPi0jv0eST9r30lJLEJEO1Q35cL2HqCM+Bdzvj:zolfH4Y9EypdMVNa+u0AyO1Q3uYqjMz
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral1/memory/1652-1-0x0000000000350000-0x00000000007D8000-memory.dmp net_reactor -
Loads dropped DLL 1 IoCs
pid Process 1652 file.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1652 set thread context of 2668 1652 file.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 2576 2668 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 1652 wrote to memory of 2668 1652 file.exe 28 PID 2668 wrote to memory of 2576 2668 MsBuild.exe 29 PID 2668 wrote to memory of 2576 2668 MsBuild.exe 29 PID 2668 wrote to memory of 2576 2668 MsBuild.exe 29 PID 2668 wrote to memory of 2576 2668 MsBuild.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 923⤵
- Program crash
PID:2576
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190KB
MD582adf2c61942c4dec4a5c66bb0dc9947
SHA1f8b6c6c0d4e513df1df83fb9deec922a8e965c3f
SHA2568db09361927194e1fa99068ddc4c0395848c90f66c3c63bd858a25fff9b681b8
SHA51253e3052c2535f0433586f1217d6fc22e6bfb3e54191435ba66def8c12ac8e229ad1f8d9f0100f3c5e2a996182d38b162553ca992f44206d287e0ce89bdcf4ac1