Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 20:33
Behavioral task
behavioral1
Sample
433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe
-
Size
13.2MB
-
MD5
9c9669f8c0c2aaedbdcf249ec5e26675
-
SHA1
eacfa5fc5f8ca866b72902db04cfe57450673905
-
SHA256
433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2
-
SHA512
da72192207ab291503df4bfd6bc88ec0d6be7fef0f7e2135fc1220deb098fd64b95ac99e89eba3c3577c370faaeec63081292b6c630205d779e56653db2b75e3
-
SSDEEP
393216:zpI7d6P5u/E+P1yKlqhRyilF/hRUTyPZ/Qb99XeuP:NI0xudAKl+AirhRUTZ
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2368-63-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-59-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/2368-39-0x0000000010000000-0x000000001003E000-memory.dmp upx -
resource yara_rule behavioral1/memory/2368-36-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-84-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-85-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-86-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-87-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-88-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-89-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-90-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-91-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-92-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-93-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-94-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-95-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-96-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect behavioral1/memory/2368-97-0x0000000000400000-0x0000000001D66000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2368 433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe 2368 433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2368 433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe 2368 433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe 2368 433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe"C:\Users\Admin\AppData\Local\Temp\433168a70d45ed84828208fe0231d7491e5c75c0faf9e958fc99791559e34cc2.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2368