Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
数码资源网.url
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
数码资源网.url
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
辅助程序/功能程序/csrss.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
辅助程序/功能程序/csrss.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
辅助程序/过游戏保护/csrss.exe
Resource
win7-20240220-en
windows7-x64
General
-
Target
辅助程序/功能程序/csrss.exe
-
Size
3.7MB
-
MD5
3df27a48a0a4d57b083a19d6e091355b
-
SHA1
622bb18e094da566242ed68954d078b9f895559c
-
SHA256
984540a91535e589856761e81215cf5635f5a236cc21bc73ea275924ee829231
-
SHA512
4aa5270dde9054e058b99f6bed35c6e2aeaaf4c0610bd79985739c7173175399d10c9957892dc4b7225643eedf2e27a3a2a6db51ba4fcd11a1b3d264630c147b
-
SSDEEP
98304:2VGeA6qMsw6x2TCjlsaNn5g8e3FEcRU/yGL:2kMr6xCc/N+8e3F/C/yQ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe 1724 csrss.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1724 csrss.exe 1724 csrss.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2312 1724 csrss.exe 28 PID 1724 wrote to memory of 2312 1724 csrss.exe 28 PID 1724 wrote to memory of 2312 1724 csrss.exe 28 PID 1724 wrote to memory of 2312 1724 csrss.exe 28