Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
e0c5f8d662301c6c002952e40449b206.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
e0c5f8d662301c6c002952e40449b206.exe
Resource
win10v2004-20240319-en
General
-
Target
e0c5f8d662301c6c002952e40449b206.exe
-
Size
36KB
-
MD5
e0c5f8d662301c6c002952e40449b206
-
SHA1
b859b3a16642c2c106c8f303ecf4949683b0edab
-
SHA256
38d1322b772475a05b9e599cec92c52a4e07fb05afd040ec068bbc1375aebd4e
-
SHA512
81b23227ce84b0ceea74f692d82414b1b98cc131689f2e7ac1cc0cc3a5e9ddd6f958699096ba231e4454e4e8e75a075727f9cba0e3a65c2c46abbe0c1dff9c9d
-
SSDEEP
384:l0mHZEBKg4thgWNSDu+iyC6pM8wc9Km7P9:l0mH4t78SPiyCss
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Classes = "C:\\Users\\Admin\\AppData\\Roaming\\024B0C.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2812 svchost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e0c5f8d662301c6c002952e40449b206.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e0c5f8d662301c6c002952e40449b206.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2888 e0c5f8d662301c6c002952e40449b206.exe 2888 e0c5f8d662301c6c002952e40449b206.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2812 2888 e0c5f8d662301c6c002952e40449b206.exe 28 PID 2888 wrote to memory of 2812 2888 e0c5f8d662301c6c002952e40449b206.exe 28 PID 2888 wrote to memory of 2812 2888 e0c5f8d662301c6c002952e40449b206.exe 28 PID 2888 wrote to memory of 2812 2888 e0c5f8d662301c6c002952e40449b206.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0c5f8d662301c6c002952e40449b206.exe"C:\Users\Admin\AppData\Local\Temp\e0c5f8d662301c6c002952e40449b206.exe"1⤵
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Adds policy Run key to start application
- Deletes itself
PID:2812
-