Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 13:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
backproxy.rar
Resource
win7-20240704-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
backproxy.rar
Resource
win10v2004-20240730-en
3 signatures
150 seconds
General
-
Target
backproxy.rar
-
Size
61KB
-
MD5
8e8c7da28f740f2534440f19a74b08c4
-
SHA1
cb4a1fa77e6040e2f7e9d8273129ec67d29f6fc4
-
SHA256
32f090a30128135e5f7259a001152a15ef117f7f575156d89effc11c88cdf8fe
-
SHA512
1cbdcc559b3c784e7714fa36f06f1b1fcdb0cfae5ee2e12d4f3fc459a235926b4e285019e2ef8a7b11124faf3578c3457fd5199da4667105c9bbc2e599d919e9
-
SSDEEP
1536:5c9ys+UwfJ91akffU08Mf8r6Ikldn1AGH2kcA/cualT9E+VYQ:K9yswfL1akniAIc1vuA/alpj
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2828 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2828 2636 cmd.exe 31 PID 2636 wrote to memory of 2828 2636 cmd.exe 31 PID 2636 wrote to memory of 2828 2636 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\backproxy.rar1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\backproxy.rar2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2828
-