Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

EC33A68C48...2E.exe

windows7-x64

8

EC33A68C48...2E.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    1217s
  • max time network
    1220s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2022, 18:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    EC33A68C48318850FF70D3486A9E4380193E0C2E.exe

  • Size

    207KB

  • MD5

    004bb3a15150c44c8a7e2d9c2ad1d2df

  • SHA1

    ec33a68c48318850ff70d3486a9e4380193e0c2e

  • SHA256

    635c9471bd97a521ef8bd5d824621c89b73db6577b5d31b31674f70802a03248

  • SHA512

    772a233c7549637094e6756d12969f5624cd0be7672c47f369ee2c0a4e7c3a7466d3f2ec090f5d3c55457e4bcbeb526bd45d580b65a8e6480f6e6ca0f4d17c78

  • SSDEEP

    3072:WGUKcZkP/Rk2NNDeQ/HGXyb6+tCc56/8nIA5AOHoa1NGhkeVbpJivFqgynIbE1Ru:yKJRFNN1LgcA/8IA7oa1NYXyF3yIbGt

Score
8/10
evasion

Malware Config

Signatures

  • Disables Task Manager via registry modification
    evasion
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EC33A68C48318850FF70D3486A9E4380193E0C2E.exe
    "C:\Users\Admin\AppData\Local\Temp\EC33A68C48318850FF70D3486A9E4380193E0C2E.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2040-132-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2040-133-0x0000000074D00000-0x00000000752B1000-memory.dmp

    Filesize

    5.7MB

    Download