Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 14:46
Static task
static1
Behavioral task
behavioral1
Sample
0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe
Resource
win10v2004-20220812-en
General
-
Target
0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe
-
Size
191KB
-
MD5
dddda698021cff9d7d4e74a9515cc206
-
SHA1
8d3338592b6c5ea1fedb4ad67e5a6b40079f5a79
-
SHA256
0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9
-
SHA512
bb0aad58df904f6595af3e02463d1cc970e27cdc065eaca8d30b508da8b2644a1dd08d96d6c85b95a8f0e789cb48b6b1d37c5ee784775a1b7cb7c73ff4797979
-
SSDEEP
3072:fCfLg8ssfEiZt9pi4Q7ukOEHNos9M1a60VERFT03kc:nHGEiOF7zHNea60Ov2
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4492 wrote to memory of 1040 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe 51 PID 4492 wrote to memory of 1040 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe 51 PID 4492 wrote to memory of 1040 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe 51 PID 4492 wrote to memory of 1040 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe 51 PID 4492 wrote to memory of 1040 4492 0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe 51
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe"C:\Users\Admin\AppData\Local\Temp\0297d7d771e9fe0fa5bf26e7ff820c2336c36a9f6aa975e5d4460a4bed88e2d9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4492
-