Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e0a66c17b87785c2219b153c7761e9b5.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e0a66c17b87785c2219b153c7761e9b5.exe
Resource
win10v2004-20240319-en
3 signatures
150 seconds
General
-
Target
e0a66c17b87785c2219b153c7761e9b5.exe
-
Size
236KB
-
MD5
e0a66c17b87785c2219b153c7761e9b5
-
SHA1
86175e50ba3725a9ba04f780ace4b5e1c99e85a1
-
SHA256
f68d6bb913291cc7b6168b9648404deb8a7a0a59c367bdb7fddbf3a1cdd37df9
-
SHA512
2e56d82eab904340cf03ea6344840a9001dfb41e86711aef5e4301abc1c7b22fdb40e7fb36781db93208d45b21fcfc3c186fad810b320b5f706ca5a2de87a352
-
SSDEEP
6144:p8zgNLrtxHDRTq/iMmHkOw3fs4YFkhJbvGlwXI42/I/3u:pnNLrtxHDRTqKtEOwPsGhxtIRI/
Score
8/10
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\BITS\Parameters\ServiceDll = "C:\\Windows\\system32\\System64.dll" e0a66c17b87785c2219b153c7761e9b5.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\System64.exe e0a66c17b87785c2219b153c7761e9b5.exe File opened for modification C:\Windows\SysWOW64\System64.exe e0a66c17b87785c2219b153c7761e9b5.exe File created C:\Windows\SysWOW64\System64.dll e0a66c17b87785c2219b153c7761e9b5.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2464 2940 e0a66c17b87785c2219b153c7761e9b5.exe 27 PID 2940 wrote to memory of 2464 2940 e0a66c17b87785c2219b153c7761e9b5.exe 27 PID 2940 wrote to memory of 2464 2940 e0a66c17b87785c2219b153c7761e9b5.exe 27 PID 2940 wrote to memory of 2464 2940 e0a66c17b87785c2219b153c7761e9b5.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0a66c17b87785c2219b153c7761e9b5.exe"C:\Users\Admin\AppData\Local\Temp\e0a66c17b87785c2219b153c7761e9b5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\e0a66c17b87785c2219b153c7761e9b5.exeC:\Users\Admin\AppData\Local\Temp\e0a66c17b87785c2219b153c7761e9b5.exe -Nod322⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
PID:2464
-