Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 04:34
Static task
static1
Behavioral task
behavioral1
Sample
6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe
Resource
win10v2004-20220901-en
General
-
Target
6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe
-
Size
568KB
-
MD5
92c117e3dea5e42c9c7c43156f001610
-
SHA1
72483696ee47a7f8281ba2b79620bf8e79162d5e
-
SHA256
6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4
-
SHA512
7e2bbc3c0005bbb3aeba813a78d38a516b4250f0acac4d1549bad0e2d45e6a2c0843282e2700a0ca90f2d59032fea6eeafb12231d152e5cc93d2d9834fcdd8a4
-
SSDEEP
6144:fZfV+kxG0TuVgE1Eax5wb/y0GjwAYmD3cPD419b6EHVCWrWohlCDhg2H:R9+kkxEax5a/9vq9b11fZ+DS
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 692 6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe 692 6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 692 wrote to memory of 3940 692 6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe 81 PID 692 wrote to memory of 3940 692 6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe 81 PID 692 wrote to memory of 3940 692 6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe"C:\Users\Admin\AppData\Local\Temp\6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe_And DeleteMe.bat""2⤵PID:3940
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\6cb6d5cd4821af9cc84311e44697aeb7b4991b3146a750088991e46373a98de4.exe_And DeleteMe.bat
Filesize246B
MD5807bc85e2c3484a8170e8ba09535308d
SHA1bba4c499b8a7bfe67b3551d509314dee3a57551a
SHA256dcc5f5ac2b348e329f2db8d88b5217740215088159796eb95ec4f7358da2a9c3
SHA512796f73241671d00cd0ded690619776dc02d278601ba1c850c9c7341c863d9361ce626de9c3e8c6603ee2d9b49cd04488ddf7d9fa941813d3c712105c66e9fc79