Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
13/02/2024, 05:32
Static task
static1
Behavioral task
behavioral1
Sample
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe
Resource
win10v2004-20231215-en
General
-
Target
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe
-
Size
949KB
-
MD5
3785efc90f48f4d73f80ac7c8a681cca
-
SHA1
e7bf26ad61392721a29b952794d72dc6f776e17d
-
SHA256
d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5
-
SHA512
249e4ddd349473f2469bf6a1e66c90c8478e94d2247c01f2d7338fb5caf6eec10560b88fdb850cc90de4ed3c70e24ff2bb09dce576f5b78940c682e13cae6f59
-
SSDEEP
24576:aRmJkcoQricOIQxiZY1iaK4hL8NzjA3xBJ4tgajm:/JZoQrbTFZY1iaKJlA3HSgaS
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 620 set thread context of 2388 620 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 28 PID 2388 set thread context of 1248 2388 svchost.exe 15 PID 2388 set thread context of 2992 2388 svchost.exe 29 PID 2992 set thread context of 1248 2992 regsvr32.exe 15 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2388 svchost.exe 2388 svchost.exe 2388 svchost.exe 2388 svchost.exe 2388 svchost.exe 2388 svchost.exe 2388 svchost.exe 2388 svchost.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe 2992 regsvr32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 620 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 2388 svchost.exe 1248 Explorer.EXE 1248 Explorer.EXE 2992 regsvr32.exe 2992 regsvr32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 620 wrote to memory of 2388 620 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 28 PID 620 wrote to memory of 2388 620 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 28 PID 620 wrote to memory of 2388 620 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 28 PID 620 wrote to memory of 2388 620 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 28 PID 620 wrote to memory of 2388 620 d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe 28 PID 1248 wrote to memory of 2992 1248 Explorer.EXE 29 PID 1248 wrote to memory of 2992 1248 Explorer.EXE 29 PID 1248 wrote to memory of 2992 1248 Explorer.EXE 29 PID 1248 wrote to memory of 2992 1248 Explorer.EXE 29 PID 1248 wrote to memory of 2992 1248 Explorer.EXE 29 PID 1248 wrote to memory of 2992 1248 Explorer.EXE 29 PID 1248 wrote to memory of 2992 1248 Explorer.EXE 29
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe"C:\Users\Admin\AppData\Local\Temp\d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\d06324e91d5b7f81c9a144fb520c5896f82899271c1632ee0fbc0687a17cc4c5.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2388
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
246KB
MD5b5c70fa9f3d2775e1da717518c2baa0b
SHA1aaf215b5c1e4fb2cbc7de1d16bdfb5c4177a16c9
SHA256922e67203e6992e05a8d36ba41a34f1cebedccc2d556f0e4123180a0b422302f
SHA5121a15e5690c8f29da8e8000d449de88b375126a00eceedf1a6f49581a58ade843baa91ce56955cfa353c4337bb9b2f5120275496dbc87b6a9354eade1b128e3cb