Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
01/07/2024, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe
Resource
win10v2004-20240508-en
General
-
Target
3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe
-
Size
476KB
-
MD5
566dcb7c5cc7df524025c3c35feafdbe
-
SHA1
bfc7d2e5ef315daaa18b09410f1fb9f4dc3601cb
-
SHA256
3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db
-
SHA512
4a6e1d7cc0adb4ba0b45b58da46448e3a6291164372687d195427f6e40a6fdeb4b34740970bc235f735a054271108517e1c9b91f3c6a2ec525dc8e4c35590d28
-
SSDEEP
3072:Jin8r+coP2W0XgEU5IuY2R8FD8edLhb9x4CuSqhAp08FkGRnNrdf45AjqKnoem:23P0KPsvKhAp081nNVjqKoe
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 9 IoCs
resource yara_rule behavioral1/memory/19640-26757-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/19640-26756-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/19640-26755-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/19640-26752-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/19640-26760-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/19640-26800-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/19640-53539-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/81164-53532-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/memory/81164-53542-0x0000000000400000-0x000000000040B000-memory.dmp UPX -
resource yara_rule behavioral1/memory/19640-26757-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/19640-26756-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/19640-26755-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/19640-26752-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/19640-26750-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/19640-26760-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/19640-26800-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/19640-53539-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/81164-53532-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/81164-53542-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1864 3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe"C:\Users\Admin\AppData\Local\Temp\3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe"C:\Users\Admin\AppData\Local\Temp\3a5833df19607946bc8cb51577675176b6b4f55a87c1b2ec72ce9025b93f12db.exe"2⤵PID:19640
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\SPOSG.bat" "3⤵PID:19848
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "JREsp7" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SunJavaJREupdate7\JREUPD7.exe" /f4⤵PID:19900
-
-
-
C:\Users\Admin\AppData\Roaming\SunJavaJREupdate7\JREUPD7.exe"C:\Users\Admin\AppData\Roaming\SunJavaJREupdate7\JREUPD7.exe"3⤵PID:19924
-
C:\Users\Admin\AppData\Roaming\SunJavaJREupdate7\JREUPD7.exe"C:\Users\Admin\AppData\Roaming\SunJavaJREupdate7\JREUPD7.exe"4⤵PID:81164
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵PID:81240
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
153B
MD5a5ab6d6b7f03c59f02ebde6e2834fe42
SHA1567e8e08dcb41c365116e5806676d89e2b9f522a
SHA2562dfac769e0e863a3f534444566bbc908edb7fed1981feed55a8f402cc7a3e506
SHA512271f94ed4f69eb40012e26aae164a0332bc3695d08f119e82096a4a14e15631e8a6ee7c8095d047ba5e2ae03e364c010b873a5f3191ab88a835ae2227ddc30bd
-
Filesize
476KB
MD51b8ecb57ab5db3b686b500eb6abf76e9
SHA10c45203a70e0f40ed0c0b27bab2218947c4222fd
SHA2569fb39798c00a5c23ad67466355a3d1c9dde0d0ce1326c56103f6891bb0c6cb6d
SHA51282d48fc7c0d005798e0dde4ef4a673b44c361a0d7f8cad84c23ddfe70282c27859a46807d666ea716a4d2481396a8955bd477cd7c278d82268b5b6a8b70ac089