Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b637263f06de03519ec48f2745f0879f.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b637263f06de03519ec48f2745f0879f.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
b637263f06de03519ec48f2745f0879f.exe
-
Size
784KB
-
MD5
b637263f06de03519ec48f2745f0879f
-
SHA1
fbf6376d8900eb62bb1213004e63303325a280f0
-
SHA256
a9c1a1107b7339a497fcb30ad6a20151d957178e92e04b7f1686606218a83468
-
SHA512
ce61320a57f4e7a6d67374228ccd72593975c10e26629e7a7fb5532c2de374f2c8f0f59f58ed9e0705f287097606fe9ee9326ff2ac9727c1990b186051015c76
-
SSDEEP
12288:lTAQA7nSOfZJiOSTbbwukHX9+/RFaxqYtE33733N:lTAQ1OfZJiOSMukXwvFeS
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Windows\\wupdmgr.exe" b637263f06de03519ec48f2745f0879f.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wupdmgr.exe b637263f06de03519ec48f2745f0879f.exe File opened for modification C:\Windows\wupdmgr.exe b637263f06de03519ec48f2745f0879f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1312 b637263f06de03519ec48f2745f0879f.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1312 b637263f06de03519ec48f2745f0879f.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe 1312 b637263f06de03519ec48f2745f0879f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b637263f06de03519ec48f2745f0879f.exe"C:\Users\Admin\AppData\Local\Temp\b637263f06de03519ec48f2745f0879f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1312