Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 04:24
Static task
static1
Behavioral task
behavioral1
Sample
8e356b74e94134488fcd288edbe4f93c.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
8e356b74e94134488fcd288edbe4f93c.exe
Resource
win10v2004-20231215-en
1 signatures
150 seconds
General
-
Target
8e356b74e94134488fcd288edbe4f93c.exe
-
Size
64KB
-
MD5
8e356b74e94134488fcd288edbe4f93c
-
SHA1
7f261292375f01cd62ba1f803ad968b67ab663b1
-
SHA256
6d0feee7f132b79b264dabb2831413182f6c2f102151b2e088663cf38005dddb
-
SHA512
8e6cc8660266c4b0216adb8c64b4d5c70d0577c6ed5ec369bf15d1c87b2e79fdb4338383d434eeed0e087acb6e45859ac7867c5e86e150d7de1cf19c209192f9
-
SSDEEP
1536:WWNmJpV0IkdmRJ5phPd90+ro2cQDaisKldR:y0m35nI+ro4V
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe" 8e356b74e94134488fcd288edbe4f93c.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\runouce.exe 8e356b74e94134488fcd288edbe4f93c.exe File opened for modification C:\Windows\SysWOW64\runouce.exe 8e356b74e94134488fcd288edbe4f93c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2180 2052 8e356b74e94134488fcd288edbe4f93c.exe 28 PID 2052 wrote to memory of 2180 2052 8e356b74e94134488fcd288edbe4f93c.exe 28 PID 2052 wrote to memory of 2180 2052 8e356b74e94134488fcd288edbe4f93c.exe 28 PID 2052 wrote to memory of 2180 2052 8e356b74e94134488fcd288edbe4f93c.exe 28 PID 2052 wrote to memory of 2180 2052 8e356b74e94134488fcd288edbe4f93c.exe 28 PID 2052 wrote to memory of 2180 2052 8e356b74e94134488fcd288edbe4f93c.exe 28 PID 2052 wrote to memory of 2180 2052 8e356b74e94134488fcd288edbe4f93c.exe 28 PID 2052 wrote to memory of 1336 2052 8e356b74e94134488fcd288edbe4f93c.exe 6 PID 2052 wrote to memory of 1336 2052 8e356b74e94134488fcd288edbe4f93c.exe 6
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\8e356b74e94134488fcd288edbe4f93c.exe"C:\Users\Admin\AppData\Local\Temp\8e356b74e94134488fcd288edbe4f93c.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\8e356b74e94134488fcd288edbe4f93c.exe"C:\Users\Admin\AppData\Local\Temp\8e356b74e94134488fcd288edbe4f93c.exe"3⤵PID:2180
-
-