Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/06/2024, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe
Resource
win10v2004-20240226-en
General
-
Target
79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe
-
Size
40KB
-
MD5
9640a99ce6ca8bba18ff4b117e124b2b
-
SHA1
2bab128a25efd9b2b0f67c276e1b6801729da8e6
-
SHA256
79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7
-
SHA512
bfce9c139f54f0d90043ae3383ece3023bc8b028bf656182d89ca949566f67dae857731b4ab1f6b98090a022d863b26cfb1b2e166a9e32d52c35818ebf4d0fb5
-
SSDEEP
768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhb:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wY7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2984 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2984 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2984 2912 79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe 28 PID 2912 wrote to memory of 2984 2912 79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe 28 PID 2912 wrote to memory of 2984 2912 79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe 28 PID 2912 wrote to memory of 2984 2912 79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe"C:\Users\Admin\AppData\Local\Temp\79530b48e96df88dfba6140fda649b6841e423f876a4c2d114cff4264332ffb7.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:2984
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5f00bf999faf69c046ad2c9756d7f5fc4
SHA12fb04742bc9eed655c555185f2c6194d45df293e
SHA25672eadd16d7b26c4c1bd4d097d912da084b2e051c67acae0fd4288a596065a2de
SHA5121ff7c2e425d9f95754a9d99336e8fc148f5ba1534bc633807ffc6312c00d10545856a25fec8b5b64388acc4009dd84e12d6841707c511d856cd5473ddb0147b3