Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b461d6c2ee91e30a81bc82ed84168b0d.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
b461d6c2ee91e30a81bc82ed84168b0d.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
b461d6c2ee91e30a81bc82ed84168b0d.exe
-
Size
26KB
-
MD5
b461d6c2ee91e30a81bc82ed84168b0d
-
SHA1
03e3f94aad9760bab5b65cebd71ad03b54b7f4f5
-
SHA256
f07ad8074d2626e12b969b10c0e65a1c2d83175a0f717db93d768e10dce46c0c
-
SHA512
7f9d8b6b75b5309f2e1304363210a96d882b35bfb2051bbc8f594191e2353dc1422f500aacf2ca7cf5f3f96504e19d6c7229a74b3a26cf12e9e2d589bfef96b9
-
SSDEEP
384:jOKOlGibzO5K+o8A+Q3Fo3+Gc0gz2GOzKIbjG+uclw6rN9zvL/VZ4IzWn:jONF/YRo1+Q0cTGRbjdL9vL/vfCn
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\ProgramData\\22CC6C32.exe" b461d6c2ee91e30a81bc82ed84168b0d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\22CC6C32.exe" b461d6c2ee91e30a81bc82ed84168b0d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2308 b461d6c2ee91e30a81bc82ed84168b0d.exe