Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/10/2022, 16:17

General

  • Target

    0665d9cdce516e0a5f76e42fe35f5f45fe9795f46b296a6ea12648a56b8b92c3.exe

  • Size

    229KB

  • MD5

    91c5a6ecb14524d2ef666b23a32f331c

  • SHA1

    0be71ab92cecb21cd72b49dda3c7141dfa3bd980

  • SHA256

    0665d9cdce516e0a5f76e42fe35f5f45fe9795f46b296a6ea12648a56b8b92c3

  • SHA512

    6e5d88e98cef3e63a2832cb01c215c84095df82b8123efe581ae06e07e2ed6a5251de51a0c34728a93be86656a7470f9920aec21af6bd50c2193f73cbe3b89e5

  • SSDEEP

    1536:uGf+rNWEDRrlCZrFl0XETaBNBDedVU3N/BGD2EzznpUzkh54cNOdQY+4wO:uG68m9hpqud9E3npYkh5zp1O

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2720
      • C:\Users\Admin\AppData\Local\Temp\0665d9cdce516e0a5f76e42fe35f5f45fe9795f46b296a6ea12648a56b8b92c3.exe
        "C:\Users\Admin\AppData\Local\Temp\0665d9cdce516e0a5f76e42fe35f5f45fe9795f46b296a6ea12648a56b8b92c3.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Users\Admin\AppData\Local\Temp\0665d9cdce516e0a5f76e42fe35f5f45fe9795f46b296a6ea12648a56b8b92c3.exe
          "C:\Users\Admin\AppData\Local\Temp\0665d9cdce516e0a5f76e42fe35f5f45fe9795f46b296a6ea12648a56b8b92c3.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1028

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1028-135-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1028-138-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1028-139-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/2720-140-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

      Filesize

      24KB

    • memory/4940-137-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB