Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/07/2024, 11:05
240708-m639fsyaph 408/07/2024, 11:00
240708-m359msxhrf 308/07/2024, 10:54
240708-mzmm5avgrj 308/07/2024, 10:49
240708-mw431axfra 708/07/2024, 10:46
240708-mtxwxaxfjc 308/07/2024, 10:42
240708-mrn6zsxekb 7Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
AntivirusDefender8.0-main.zip
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
AntivirusDefender8.0-main/.gitattributes
Resource
win7-20240704-en
Behavioral task
behavioral3
Sample
AntivirusDefender8.0-main/AntivirusDefender8.0.lnk
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
AntivirusDefender8.0-main/LICENSE
Resource
win7-20240705-en
Behavioral task
behavioral5
Sample
AntivirusDefender8.0-main/README.md
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
AntivirusDefender8.0-main/RUNTHISFIRST.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
AntivirusDefender8.0-main/bootmgfw.dll
Resource
win7-20240221-en
General
-
Target
AntivirusDefender8.0-main/RUNTHISFIRST.exe
-
Size
9KB
-
MD5
1a7514c839000a811e123d97d818c1e9
-
SHA1
925b53693ef965b68c797eb5c995de539f0e0288
-
SHA256
cc3657cd6f186055334ccd88f8aac5457265a03b31274517d763fe32003b65ca
-
SHA512
15c101b2160b8cc9c0f94e6e9e0442598cb16b21b9b69cad48f3f0741e16885d3ddb4b2deafb4739c0ca1db4345f1f45ceae9dad08f21daafc38a8e99f3c4f91
-
SSDEEP
96:xuF96Fu+DPL/Ej5tjCRIf/cGAPVEVB8lvQ53WNtaYc0PkMZOjlNSr0Pk1YHAd4sD:x+UTEjyU2PVEVmC584YcekMiur0M1Y4
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2408 3032 RUNTHISFIRST.exe 31 PID 3032 wrote to memory of 2408 3032 RUNTHISFIRST.exe 31 PID 3032 wrote to memory of 2408 3032 RUNTHISFIRST.exe 31 PID 3032 wrote to memory of 2408 3032 RUNTHISFIRST.exe 31 PID 2408 wrote to memory of 1736 2408 cmd.exe 33 PID 2408 wrote to memory of 1736 2408 cmd.exe 33 PID 2408 wrote to memory of 1736 2408 cmd.exe 33 PID 2408 wrote to memory of 1736 2408 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe"C:\Users\Admin\AppData\Local\Temp\AntivirusDefender8.0-main\RUNTHISFIRST.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c mountvol x: /s2⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\mountvol.exemountvol x: /s3⤵PID:1736
-
-