Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
Resource
win10v2004-20220812-en
General
-
Target
633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
-
Size
2.0MB
-
MD5
65790c132b9be132b3ef592ccb57c720
-
SHA1
bd6265715b57c7b25cba5a4daa82c2150b467e49
-
SHA256
633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560
-
SHA512
09ab14b4738dd6e70511b71965bf831de951ec66294efaee7149655687ceaac9683860f919fc5100b5bc1ffb79725925503bd9c293510853ca0bfe2c4760f6da
-
SSDEEP
24576:GKB58mnEzeDI4SY2SNxSuYPveP2HSC5Y+1YhL7:bqmEBoFP2y1+1
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4764 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 4764 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 5060 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 5060 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 1520 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 1520 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 2072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 2072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 5072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 5072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 3420 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 3420 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3456 wrote to memory of 4764 3456 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 81 PID 3456 wrote to memory of 4764 3456 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 81 PID 3456 wrote to memory of 4764 3456 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 81 PID 4764 wrote to memory of 5060 4764 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 82 PID 4764 wrote to memory of 5060 4764 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 82 PID 4764 wrote to memory of 5060 4764 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 82 PID 5060 wrote to memory of 1520 5060 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 87 PID 5060 wrote to memory of 1520 5060 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 87 PID 5060 wrote to memory of 1520 5060 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 87 PID 1520 wrote to memory of 2072 1520 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 91 PID 1520 wrote to memory of 2072 1520 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 91 PID 1520 wrote to memory of 2072 1520 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 91 PID 2072 wrote to memory of 5072 2072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 92 PID 2072 wrote to memory of 5072 2072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 92 PID 2072 wrote to memory of 5072 2072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 92 PID 5072 wrote to memory of 3420 5072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 93 PID 5072 wrote to memory of 3420 5072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 93 PID 5072 wrote to memory of 3420 5072 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 93 PID 3420 wrote to memory of 4612 3420 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 95 PID 3420 wrote to memory of 4612 3420 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 95 PID 3420 wrote to memory of 4612 3420 633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe"C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M8⤵PID:4612
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84B
MD57d637ae73aecbc3c95aa3cb5fa422d0f
SHA1afb40776f6563bed8460e9cc93f6489b82b2cd38
SHA2563d84eee4d18c0a38204ea5f4154049d6e69f75520d9ba2f82c31f2fd0fe30d10
SHA51274d2bea1d115d01997921a66fcfb75560770eba58615f79c71350e0b83e25efe62317990a83389ab827d3140cc1d0d837e35e950e398f55f045a2fc4a5b4ef15
-
Filesize
126B
MD5c46abf06731263e8a0b3214c3c77311b
SHA10dd38a2174663b577e1d7eda15e64835a9d792d6
SHA256eab11e1098341133577c9ab40660550a25754be4d5c0832e8989836953186597
SHA5123fc8a9c5d81cbfc2d2391e609952dfea3b3cb2c520ac8e808db1f6205d6703a604e00675395b862ed1f8c7fd8243549825bd58d128ec20e7b79dcd77e6a905ea
-
Filesize
168B
MD5f6deb266f36182f5afe152405f29ec00
SHA14db10482bd3167dfc0a5a8b9238c80b81db102de
SHA256cb6c06b386307186bd78c2492be3d39f47336ce84a54a82bb82e5727f8f8d2b5
SHA5121ebaf47455c9f9d792460c2b6d3232492cba3da77a695a014d85cc5a088a59127526173cbe7fe37629c2a1ac2c2fb265662cfa41b914230a00a4f7cc68ddb72a
-
Filesize
210B
MD5dc3b36ecfeb685abe5993f06d8378481
SHA1d98e5169230a959fcd8bbbec28db2ced9614c7ef
SHA2565f5f15dc17867564e811431edc9828e03fd2ae3832bb621dcf5d6162027b4799
SHA5125a316aee08580198996bac857f6b03e9c4116006b814b56eb8148c0ab79770280ae039fbc1135023ae985ed826902e3255bf46d59cd8708a97782c2c3ecbebdb
-
Filesize
252B
MD5363d733c527290f35411a5ac7da3a4c8
SHA125d72f560eb249429a2a16a328f17af91a8c59f7
SHA256645810eb232af260b927c75ed0df1d01211706373100f196f890d626f93af03c
SHA51270fb3f702bb6572817a7df8b1bb64cd6af8f1470528f81123b4035a11f1524670ff5854c3318021738c56eb3053bc5f0513990943768c94d4e8b4af5d3a67db9
-
Filesize
294B
MD5f536fd60d4d0ef8353b5f52d93af7627
SHA1bc5666110997906d2b76c5754fcc73cab274871f
SHA2561aa7527609291ba049f87fb986936cb6afeed0a988817b342c70076ce47dc62c
SHA51264a9a28a146e91e247ac0481bca88bc65035298ff541c1e8b0ffcc9ebaa445103a63a7e062048faccf2da35aa2a3715f459350a69f3489e249741ee9d571ea9c