Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe
Resource
win10v2004-20220812-en
General
-
Target
063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe
-
Size
307KB
-
MD5
a0f8d2b078ce4c93dcbbef7d231e06cf
-
SHA1
9a154f7e7332c3e9b2f50b08d73f30abff55c547
-
SHA256
063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c
-
SHA512
d08ffb8d21678ea3f5e86db2fc1c51cc1491ed84565356081caeee42b7b627b518660d4598f737ba6b8b9dfa633b2badd91b08f364ef1b62ebf8991f5db9db4d
-
SSDEEP
3072:iyf8n+BnNpiXN5U+M/hQuaCA3VMxDJAQO7LN:i/+BnNpCqP/hQuavirOH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4852-134-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4852-137-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4852-136-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4852-142-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4916 set thread context of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4852 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4916 wrote to memory of 4880 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 17 PID 4916 wrote to memory of 4880 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 17 PID 4916 wrote to memory of 4880 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 17 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18 PID 4916 wrote to memory of 4852 4916 063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe 18
Processes
-
C:\Users\Admin\AppData\Local\Temp\063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe"C:\Users\Admin\AppData\Local\Temp\063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe2⤵PID:4880
-
-
C:\Users\Admin\AppData\Local\Temp\063e2a5a39e6c5c4bfb05866fc927dae5993016dea5f45a207ac41e16404ae4c.exe
- Suspicious use of SetWindowsHookEx
PID:4852 -
C:\Users\Admin\E696D64614\winlogon.exe"C:\Users\Admin\E696D64614\winlogon.exe"3⤵PID:4240
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\\svchost.exe1⤵PID:1428
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30KB
MD5cfdefc5ec9567549fdb87758988e3512
SHA17cbab99c72481cf43ffcefb4cb8ac478b29bff49
SHA2568d6d5df0b660aaeddb51aaf45c3cdb1b28396c15259a8a1482a024bb1cf392d0
SHA512f41355f2e15430cc6ae6526c4973124174520db722bb9f13041bdd41981527ecc19bcd20e52e43dca6b746cd346062ae57da9d0e79b223d2c201b30b5d2ce6d3
-
Filesize
8KB
MD5e4ff4f42d1da8064700e699d36021e39
SHA1394e9249ad3b5828f5bc38cc0d6d3f2e4046ae21
SHA2567763cc9750491a15299abd0be3e0dd03848f06f061f628a611a2569bf6c5b207
SHA512e1e1dda7569724169b171fb725ca2c008bfb09bbcf5324c30bf1c20b7ca6225c7893a7b23b7700621612bf5be53670c8c622376695203e7eb2c8ff73fbb224a2