Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/08/2024, 21:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
C11Executor23.exe
Resource
win7-20240708-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
C11Executor23.exe
Resource
win10v2004-20240802-en
3 signatures
150 seconds
General
-
Target
C11Executor23.exe
-
Size
515KB
-
MD5
66a87c841aa4cdb915dd9940c2f6cd64
-
SHA1
35a28ebd8184af91f825b4dd1ea85af74bd2b1c3
-
SHA256
9082c8a1083ba1cd9e58a767eddfa11e84fcca0915e846219a7080dd7645a6cb
-
SHA512
19dd13169b031b64558fa4024b403e8ad66d0b9f3b82705c3eca77715a5bb4ee2fa7abf7b8b0ad850816bb30c5813aed03319b55490e16bdf7e236e40cd292f2
-
SSDEEP
12288:/iPu2vepKVQB4jd+UAdnSZaJ0CF7DUNaqjnznegDEIey7WDQdz:/MRvePsd+UAd8aTZDQamnznegVP7WDQ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1724 2080 C11Executor23.exe 30 PID 2080 wrote to memory of 1724 2080 C11Executor23.exe 30 PID 2080 wrote to memory of 1724 2080 C11Executor23.exe 30 PID 1724 wrote to memory of 2380 1724 C11Executor23.exe 31 PID 1724 wrote to memory of 2380 1724 C11Executor23.exe 31 PID 1724 wrote to memory of 2380 1724 C11Executor23.exe 31 PID 2380 wrote to memory of 2680 2380 C11Executor23.exe 32 PID 2380 wrote to memory of 2680 2380 C11Executor23.exe 32 PID 2380 wrote to memory of 2680 2380 C11Executor23.exe 32 PID 2680 wrote to memory of 2744 2680 C11Executor23.exe 34 PID 2680 wrote to memory of 2744 2680 C11Executor23.exe 34 PID 2680 wrote to memory of 2744 2680 C11Executor23.exe 34 PID 2744 wrote to memory of 2848 2744 C11Executor23.exe 35 PID 2744 wrote to memory of 2848 2744 C11Executor23.exe 35 PID 2744 wrote to memory of 2848 2744 C11Executor23.exe 35 PID 2848 wrote to memory of 2732 2848 C11Executor23.exe 36 PID 2848 wrote to memory of 2732 2848 C11Executor23.exe 36 PID 2848 wrote to memory of 2732 2848 C11Executor23.exe 36 PID 2732 wrote to memory of 2920 2732 C11Executor23.exe 37 PID 2732 wrote to memory of 2920 2732 C11Executor23.exe 37 PID 2732 wrote to memory of 2920 2732 C11Executor23.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"C:\Users\Admin\AppData\Local\Temp\C11Executor23.exe"8⤵PID:2920
-
-
-
-
-
-
-