Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 12:22
Behavioral task
behavioral1
Sample
b931920c17042d36d1fcaac5ca6cac20N.exe
Resource
win7-20240708-en
General
-
Target
b931920c17042d36d1fcaac5ca6cac20N.exe
-
Size
9.8MB
-
MD5
b931920c17042d36d1fcaac5ca6cac20
-
SHA1
bb7a8d7cfcd28aafc210fa988f2b3356dbcd0feb
-
SHA256
e7d65d47715eb27f4385a5fe74335623081feb128d330ed5c9fb2c5f9da08394
-
SHA512
c2bd1d959d20be185fc2ecafa04e1a1b3fc0aa711e57572e5d48cd9f4052afb5f522d8e11344a2e292fb0b2c8324eec8a5a5c652983fac1b799bac8769494bd9
-
SSDEEP
98304:rGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGyooooooooooooooooooq:Q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2000 svrwsc.exe -
resource yara_rule behavioral1/memory/1820-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/files/0x000a0000000120d5-4.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe b931920c17042d36d1fcaac5ca6cac20N.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe"C:\Users\Admin\AppData\Local\Temp\b931920c17042d36d1fcaac5ca6cac20N.exe"1⤵
- Drops file in System32 directory
PID:1820
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2000
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
MD59f8d5ff3e7d0db6ef8e2a74632469f11
SHA1b985e54f21a9784641f975677624a897adb3eb93
SHA256e5faeeee6584147335688a48e957507b5a39bca35c3b98db1aae20ad03b42d5d
SHA512d44b536f12faef2008d4f8a13b4aebe9cfc41947e8bcd9ebf1d2d0bafb6283b3f8a63d5caf51bae6f48d29f0cc7f18652a133b1e2065974122dd10027ec2a0b4