Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18/05/2024, 18:38
Behavioral task
behavioral1
Sample
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe
Resource
win10v2004-20240508-en
General
-
Target
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe
-
Size
2.3MB
-
MD5
fc294c2db2de7c6270db5ea3f70125eb
-
SHA1
71ebf4c50c9b253d6829ed4544a835fa50c0d83f
-
SHA256
c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a
-
SHA512
8598f744ffc0389809fef8f153fae8ec0b0dd08d9aa0f0ab5ac00d21b7e4cbbaef8d31a26225f37ab0c3a2b549cbd3e3d1f9b9b2c8dc41e67521b4945e700eb6
-
SSDEEP
49152:RkWk5cS7a+9XYaQ+Zehc4mTYJ78V9gyBn4cX1fmP/SA8N:9ajJBZ942KQV9hp4gfmP/SA8
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 28 PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 28 PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 28 PID 1844 wrote to memory of 2752 1844 c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe"C:\Users\Admin\AppData\Local\Temp\c360385a482c6030cd6201d89f59322f06f5381a848b0ed840700bd4fa6e3d2a.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\2⤵PID:2752
-