Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/10/2022, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe
Resource
win10v2004-20220812-en
General
-
Target
d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe
-
Size
72KB
-
MD5
7547c1501613c2a042b76bba418809cb
-
SHA1
6962b3bd2e240a822355895555e7437a7bb49571
-
SHA256
d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a
-
SHA512
fc8f35ec6a383fa5e1e3ba27bbaab517d7d4f44380a79e34048804b8f4a5fb130c0b1f438d5186770b1ff225a66511c51cab4a69df72beaa576e4590f5315576
-
SSDEEP
1536:gBm/7M6RfVkOIjZJYmDHGKPt2H08MBWgFoBLFE1X/vlf3:gI/7Z18ZJFGKPwivWEX3B
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1640 d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1640 d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe 1640 d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe"C:\Users\Admin\AppData\Local\Temp\d498a89e219cae250c3c81d426055a0403dd270b6f28e9c1102f8252b47d299a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1640