Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 13:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Quotation List Pdf.exe
Resource
win7-20240508-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Quotation List Pdf.exe
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
-
Target
Quotation List Pdf.exe
-
Size
2.3MB
-
MD5
9cfd62fc26438eeb8a50922265ad0ea7
-
SHA1
6bf1e9ab8b0d0c486b85649cf3bc8c1db4b21b01
-
SHA256
7eaa347573db3f24316a9ab2d30256db4d35105c7d93f9dbf8d860ec99949280
-
SHA512
44dfe12929105d92bd1b1613ba10b3196030887b784727f646b9b17aabde242b65b87c41a9227103ab8ccb55d5163ecb5115283435b51855dc847da47e699e95
-
SSDEEP
49152:EF50a6aPVOFMx3SmroCZscivbS6mqxEWoKmqZJffp3vSsqPUceaw1GwNOmExG6f:2roA7PdsE86f
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2108 set thread context of 2700 2108 Quotation List Pdf.exe 34 -
Runs regedit.exe 1 IoCs
pid Process 2592 regedit.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2700 wmplayer.exe 2700 wmplayer.exe 2700 wmplayer.exe 2700 wmplayer.exe 2700 wmplayer.exe 2700 wmplayer.exe 2700 wmplayer.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2108 wrote to memory of 1700 2108 Quotation List Pdf.exe 30 PID 2108 wrote to memory of 1700 2108 Quotation List Pdf.exe 30 PID 2108 wrote to memory of 1700 2108 Quotation List Pdf.exe 30 PID 2108 wrote to memory of 1700 2108 Quotation List Pdf.exe 30 PID 2108 wrote to memory of 1700 2108 Quotation List Pdf.exe 30 PID 2108 wrote to memory of 2084 2108 Quotation List Pdf.exe 31 PID 2108 wrote to memory of 2084 2108 Quotation List Pdf.exe 31 PID 2108 wrote to memory of 2084 2108 Quotation List Pdf.exe 31 PID 2108 wrote to memory of 2084 2108 Quotation List Pdf.exe 31 PID 2108 wrote to memory of 2084 2108 Quotation List Pdf.exe 31 PID 2108 wrote to memory of 2084 2108 Quotation List Pdf.exe 31 PID 2108 wrote to memory of 2084 2108 Quotation List Pdf.exe 31 PID 2108 wrote to memory of 2592 2108 Quotation List Pdf.exe 32 PID 2108 wrote to memory of 2592 2108 Quotation List Pdf.exe 32 PID 2108 wrote to memory of 2592 2108 Quotation List Pdf.exe 32 PID 2108 wrote to memory of 2592 2108 Quotation List Pdf.exe 32 PID 2108 wrote to memory of 2592 2108 Quotation List Pdf.exe 32 PID 2108 wrote to memory of 2060 2108 Quotation List Pdf.exe 33 PID 2108 wrote to memory of 2060 2108 Quotation List Pdf.exe 33 PID 2108 wrote to memory of 2060 2108 Quotation List Pdf.exe 33 PID 2108 wrote to memory of 2060 2108 Quotation List Pdf.exe 33 PID 2108 wrote to memory of 2060 2108 Quotation List Pdf.exe 33 PID 2108 wrote to memory of 2700 2108 Quotation List Pdf.exe 34 PID 2108 wrote to memory of 2700 2108 Quotation List Pdf.exe 34 PID 2108 wrote to memory of 2700 2108 Quotation List Pdf.exe 34 PID 2108 wrote to memory of 2700 2108 Quotation List Pdf.exe 34 PID 2108 wrote to memory of 2700 2108 Quotation List Pdf.exe 34 PID 2108 wrote to memory of 2700 2108 Quotation List Pdf.exe 34 PID 2108 wrote to memory of 2700 2108 Quotation List Pdf.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation List Pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quotation List Pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:1700
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2084
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"2⤵
- Runs regedit.exe
PID:2592
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2060
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2700
-