Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
180s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe
Resource
win10v2004-20220812-en
General
-
Target
ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe
-
Size
315KB
-
MD5
64278e696b71b7e5db4140d6cc6199b9
-
SHA1
1cadd369eed4ce3a32e6530961d170d55eab55a8
-
SHA256
ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55
-
SHA512
2e094818f8258b355cd35d36864f02ff14201665aae15d7fb2863bbc9132e1e446dd9f3f3d99b90554e41b7993164565f19d1ff09fd0bfeffcf386ba0b85de91
-
SSDEEP
6144:qXDXL0BvnjbJDB7VHMkzQB9qnxc4B/3Rn:0b0BPjb37ykeuxc4N
Malware Config
Signatures
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\360Safe.ico ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe File created C:\Program Files (x86)\Common Files\System\360Sd.ico ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4764 ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe 4764 ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe 4764 ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe 4764 ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe"C:\Users\Admin\AppData\Local\Temp\ae675879092fafe80f7e258e139633f6ea1e4de90aeba0ac6738924e1fb1fe55.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4764