Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe
Resource
win10v2004-20240226-en
General
-
Target
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe
-
Size
14.8MB
-
MD5
79a7cb9c405655a7f033f95a9895b389
-
SHA1
35ed873cc61caea5658411679a7f42f303f18fc4
-
SHA256
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c
-
SHA512
a145f903e283fb5ccc4c4624d717d6e6de7c42eff1bce4ca95eab7937b41a0222fbc244703a5bb0dd841e36cb30d45630ce356ba8e27dd4177eb896facf5feec
-
SSDEEP
196608:sIer08mDn8g8NSHdoH8W3vA/loXvp4Pb8Ph5r/7B1KJV:eT7EBW3YtoXv6IhJ7m
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2940-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-5-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-28-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-30-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-18-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2940-47-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wy.txt cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2940 cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe 2940 cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe 2940 cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe