Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
28/07/2024, 01:48
Behavioral task
behavioral1
Sample
31efdd5ae8ee3ef23f544d3f5fd5d760N.exe
Resource
win7-20240704-en
General
-
Target
31efdd5ae8ee3ef23f544d3f5fd5d760N.exe
-
Size
9.6MB
-
MD5
31efdd5ae8ee3ef23f544d3f5fd5d760
-
SHA1
2169215181106f7b6553e53f85cd9e1105ede14c
-
SHA256
e5edbba5b2d989e6602a087353fe283475b8958942e689a08797815ba9faf6f8
-
SHA512
899bd414b148210c455b1c45a876156b35b28bc6a6f271fee526ebf77418dc1060dd1800ab0c2dcdeb99e3c2854a1826c7f61aee53ce2588cfbde876ebb23e94
-
SSDEEP
98304:rdddddddddddddddddddddddddddddddddddddddddddR444444444444444444B:p
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2956 svrwsc.exe -
resource yara_rule behavioral1/memory/1952-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x000700000001211b-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe 31efdd5ae8ee3ef23f544d3f5fd5d760N.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31efdd5ae8ee3ef23f544d3f5fd5d760N.exe"C:\Users\Admin\AppData\Local\Temp\31efdd5ae8ee3ef23f544d3f5fd5d760N.exe"1⤵
- Drops file in System32 directory
PID:1952
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2956
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.8MB
MD57b37d0c8bad8d688a3057a8b67934fc2
SHA17541857db6260aeb373362c8b33299f65bef533f
SHA256297b2b24a5db6a3851f9eb82bba80fe44502fa71c77347db63b6ee9fa51549a5
SHA5128e30f94eb215f82c18b3ceff8bc854996765647db1b34d18b8facbb84a1d0bbb520d66b5e90911ff90496d905d381995f3d1c68c743b5adaba38514018b87673