Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 10:15
Static task
static1
Behavioral task
behavioral1
Sample
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe
-
Size
152KB
-
MD5
e811834b43a7c3eb14b25551d27bf5bb
-
SHA1
c63c4cfe5aee3757f24a205e04b45f8357d28e4a
-
SHA256
85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4
-
SHA512
3edd82c715e892a07b3dffc022ff42e71b84947ae45abdf858208c7326a8703ba13ca03108d9b60af0f82362cef913e3899dc48823d36f7f605e49d123c3a846
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 428 bdif.exe -
NTFS ADS 1 IoCs
description ioc Process File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2564 wrote to memory of 428 2564 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe 67 PID 2564 wrote to memory of 428 2564 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe 67 PID 2564 wrote to memory of 428 2564 85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe"C:\Users\Admin\AppData\Local\Temp\85987df30827e939756e99075a865db9c4e2fa51ef72b5b70c2697f76ed003c4.exe"1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\programdata\e6533cd889\bdif.exec:\programdata\e6533cd889\bdif.exe2⤵
- Executes dropped EXE
PID:428
-