Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/02/2024, 16:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8QPSTVLAC5IO8.exe
Resource
win7-20231215-en
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
8QPSTVLAC5IO8.exe
Resource
win10v2004-20231215-en
16 signatures
300 seconds
General
-
Target
8QPSTVLAC5IO8.exe
-
Size
1.0MB
-
MD5
618becc84857aecef7e13a08f1b2dcae
-
SHA1
e5389cf14842defafb62f1e4319f7af46fc874a8
-
SHA256
9672142f683a4994dd8ede46b537d11b65e9782423f35bf2b0dc435512bdf007
-
SHA512
a355e394dba687ed7ccc376ae3c2472f3fb30f4cecc2dbdb36de1aa9137cb8e62c11ec5f645561a8a4ce38de1ff010f14e0eb850f9966fa5224742d7e75cb23a
-
SSDEEP
24576:+WnFP2ey/3Y5gIfbGfdufw4oIGiX4J32OMmdiksSZiGJd8QV+FYC6kuJTZ/zbIde:wbYYCnwZLbQUO6
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\System32\libcrypto-3-x64.dll 8QPSTVLAC5IO8.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1736 8QPSTVLAC5IO8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1736 8QPSTVLAC5IO8.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2072 1736 8QPSTVLAC5IO8.exe 29 PID 1736 wrote to memory of 2072 1736 8QPSTVLAC5IO8.exe 29 PID 1736 wrote to memory of 2072 1736 8QPSTVLAC5IO8.exe 29 PID 2072 wrote to memory of 2448 2072 cmd.exe 31 PID 2072 wrote to memory of 2448 2072 cmd.exe 31 PID 2072 wrote to memory of 2448 2072 cmd.exe 31 PID 2072 wrote to memory of 2656 2072 cmd.exe 32 PID 2072 wrote to memory of 2656 2072 cmd.exe 32 PID 2072 wrote to memory of 2656 2072 cmd.exe 32 PID 2072 wrote to memory of 2416 2072 cmd.exe 33 PID 2072 wrote to memory of 2416 2072 cmd.exe 33 PID 2072 wrote to memory of 2416 2072 cmd.exe 33 PID 1736 wrote to memory of 2576 1736 8QPSTVLAC5IO8.exe 34 PID 1736 wrote to memory of 2576 1736 8QPSTVLAC5IO8.exe 34 PID 1736 wrote to memory of 2576 1736 8QPSTVLAC5IO8.exe 34 PID 2576 wrote to memory of 2892 2576 cmd.exe 35 PID 2576 wrote to memory of 2892 2576 cmd.exe 35 PID 2576 wrote to memory of 2892 2576 cmd.exe 35 PID 2576 wrote to memory of 3008 2576 cmd.exe 36 PID 2576 wrote to memory of 3008 2576 cmd.exe 36 PID 2576 wrote to memory of 3008 2576 cmd.exe 36 PID 2576 wrote to memory of 1952 2576 cmd.exe 37 PID 2576 wrote to memory of 1952 2576 cmd.exe 37 PID 2576 wrote to memory of 1952 2576 cmd.exe 37 PID 1736 wrote to memory of 2544 1736 8QPSTVLAC5IO8.exe 38 PID 1736 wrote to memory of 2544 1736 8QPSTVLAC5IO8.exe 38 PID 1736 wrote to memory of 2544 1736 8QPSTVLAC5IO8.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe"C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD53⤵PID:2448
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2656
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\8QPSTVLAC5IO8.exe" MD53⤵PID:2892
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:3008
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:1952
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1736 -s 19002⤵PID:2544
-