Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 09:37
Behavioral task
behavioral1
Sample
c309708a60cd4b1d13f9ce985ce6c762.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
c309708a60cd4b1d13f9ce985ce6c762.exe
-
Size
145KB
-
MD5
c309708a60cd4b1d13f9ce985ce6c762
-
SHA1
ed68b7a79a3184602c7a6e2b6bd80ea6b49b756f
-
SHA256
4cbbc21eb54206076bf38511d59706399841ed33a2a00246247cbaf8c4a45472
-
SHA512
95e7955bf3e8f1e87720d700725254720445a99042cbd48a944fb448009b3b15812dda50e313ae354c5728f3fc293e94095e91b9bce87d1f626f56d275c334e9
-
SSDEEP
3072:BvrZ9vfaHvmXVK7Wf4VPOA9YqxNM11heJzUU9EPP+out:BvrZ9fCWf4VPNBxhoUaP+oS
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c309708a60cd4b1d13f9ce985ce6c762.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c309708a60cd4b1d13f9ce985ce6c762.exe -
resource yara_rule behavioral1/memory/2860-0-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/2860-2-0x0000000000400000-0x0000000000469000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" c309708a60cd4b1d13f9ce985ce6c762.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c309708a60cd4b1d13f9ce985ce6c762.exe -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c309708a60cd4b1d13f9ce985ce6c762.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c309708a60cd4b1d13f9ce985ce6c762.exe