Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/10/2022, 05:14

General

  • Target

    f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe

  • Size

    324KB

  • MD5

    a29fbb7457ac20ca31829b28eb2ea7e9

  • SHA1

    b4ebdcea2abb3605a715c6b40e62b5b83086065b

  • SHA256

    f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade

  • SHA512

    6397f42c1ee5fc1ea8ac54ce5c32504604b9c5da82e594964f1af7b39345a38575d09a6f15318f18b3c58d8160c52320c582a86cb5379715de9447b0349d4af7

  • SSDEEP

    6144:0sLr7KOpfQc8HPRLAQqbvwWLgbTzjhongqQf6E3zZ5011HIj84PqTKlGrB2vTtem:0sLrFpIcMgLQbhwgqY3IHY8EqOkrBoRB

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe
    "C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe
      "C:\Users\Admin\AppData\Local\Temp\f1984cdc9f918f42b41371e5f93002be8c6b720995766ed3c3ec18991c7faade.exe"
      2⤵
        PID:3628

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1144-132-0x0000000000400000-0x000000000050D000-memory.dmp

      Filesize

      1.1MB

    • memory/1144-135-0x0000000000400000-0x000000000050D000-memory.dmp

      Filesize

      1.1MB

    • memory/1144-139-0x0000000000400000-0x000000000050D000-memory.dmp

      Filesize

      1.1MB

    • memory/3628-137-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/3628-140-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/3628-141-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/3628-142-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/3628-144-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/3628-145-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/3628-146-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/3628-147-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB