Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
29/06/2024, 20:32
Static task
static1
Behavioral task
behavioral1
Sample
Win32.jerusalem
Resource
win7-20240220-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Win32.jerusalem
Resource
win10v2004-20240611-en
3 signatures
150 seconds
General
-
Target
Win32.jerusalem
-
Size
54B
-
MD5
08e75c0d7de04bfe7e1df734e8d43591
-
SHA1
b89c5d6ed02aac005b977bbc4355c281b3f28953
-
SHA256
0c7258022ec7cedc25aff4cca7e12de535055cc674f81253a8a1b2bc3f7b5d3b
-
SHA512
868f9f6476c1f99ec4885f299c0ab1eb1d1d48a781a162129831138be63732d9f542a0936ca63bb3f8723d11c09d6e952aeeeb3ab3fcceb26c9faba8c327c1c1
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2680 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2860 wrote to memory of 2680 2860 cmd.exe 29 PID 2860 wrote to memory of 2680 2860 cmd.exe 29 PID 2860 wrote to memory of 2680 2860 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Win32.jerusalem1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Win32.jerusalem2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2680
-