Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 12:38
Static task
static1
Behavioral task
behavioral1
Sample
SoftWorks.py
Resource
win7-20240708-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
SoftWorks.py
Resource
win10v2004-20240709-en
4 signatures
150 seconds
General
-
Target
SoftWorks.py
-
Size
6KB
-
MD5
008a339465d8d133a94b70f966ec9fec
-
SHA1
97b1df2be745cff224f8230cf3a783bdf1e77f8e
-
SHA256
cef9fbebf044457417badcacd0822ba13ed1c15f5271b70d5bb5c92491789c19
-
SHA512
b62a068bc3fb251f6810fa53b6416dd23a0453bdd5d79d06f624a68f0938adf320722fe4e1ec2a7667daeb5ca18394f1174222a0e79bfc97f1cb6e537f6fae20
-
SSDEEP
48:xtmESOejrHFNlv1p5P/dn49YV9/KH4H1FOgjNgtpVtNBS/1M:LrHejrHFNlvBP/dV4mZWttNBc1M
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2760 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2720 wrote to memory of 2760 2720 cmd.exe 31 PID 2720 wrote to memory of 2760 2720 cmd.exe 31 PID 2720 wrote to memory of 2760 2720 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SoftWorks.py1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SoftWorks.py2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2760
-