Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 05:14
Static task
static1
Behavioral task
behavioral1
Sample
f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe
Resource
win10v2004-20220812-en
General
-
Target
f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe
-
Size
324KB
-
MD5
a29fbb7457ac20ca31829b28eb2ea7e9
-
SHA1
b4ebdcea2abb3605a715c6b40e62b5b83086065b
-
SHA256
f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade
-
SHA512
6397f42c1ee5fc1ea8ac54ce5c32504604b9c5da82e594964f1af7b39345a38575d09a6f15318f18b3c58d8160c52320c582a86cb5379715de9447b0349d4af7
-
SSDEEP
6144:0sLr7KOpfQc8HPRLAQqbvwWLgbTzjhongqQf6E3zZ5011HIj84PqTKlGrB2vTtem:0sLrFpIcMgLQbhwgqY3IHY8EqOkrBoRB
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1144 set thread context of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82 PID 1144 wrote to memory of 3628 1144 f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe"C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe"C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe"2⤵PID:3628
-