Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21/05/2022, 11:55
Static task
static1
Behavioral task
behavioral1
Sample
SCAN_20200805_1524203946573.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SCAN_20200805_1524203946573.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
SCAN_20200805_1524203946573.exe
-
Size
1.2MB
-
MD5
94196b70530b597f111cd799149d4baf
-
SHA1
cf6749d875e1cc451890d96d26ffbc226778bb9f
-
SHA256
242c20784a19993ce2896684480243fe63d33b065fe9ef74d48b958a91cd4e48
-
SHA512
6eaba87afb85019268889f04fc0416a66628b22154d85a1ecdc136340fccace9c82b098317b2565f94a8dff9aeaa949fb0762f87c6246de80bf382f610484663
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3904 set thread context of 3856 3904 SCAN_20200805_1524203946573.exe 78 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3904 SCAN_20200805_1524203946573.exe 3904 SCAN_20200805_1524203946573.exe 4668 powershell.exe 4668 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3904 SCAN_20200805_1524203946573.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4668 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3904 wrote to memory of 3856 3904 SCAN_20200805_1524203946573.exe 78 PID 3904 wrote to memory of 3856 3904 SCAN_20200805_1524203946573.exe 78 PID 3904 wrote to memory of 3856 3904 SCAN_20200805_1524203946573.exe 78 PID 3856 wrote to memory of 1976 3856 SCAN_20200805_1524203946573.exe 79 PID 3856 wrote to memory of 1976 3856 SCAN_20200805_1524203946573.exe 79 PID 3856 wrote to memory of 1976 3856 SCAN_20200805_1524203946573.exe 79 PID 1976 wrote to memory of 4668 1976 cmd.exe 81 PID 1976 wrote to memory of 4668 1976 cmd.exe 81 PID 1976 wrote to memory of 4668 1976 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\SCAN_20200805_1524203946573.exe"C:\Users\Admin\AppData\Local\Temp\SCAN_20200805_1524203946573.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\SCAN_20200805_1524203946573.exe"C:\Users\Admin\AppData\Local\Temp\SCAN_20200805_1524203946573.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\SCAN_20200805_1524203946573.exe' & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\SCAN_20200805_1524203946573.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
-