Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 04:29
Static task
static1
Behavioral task
behavioral1
Sample
1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe
Resource
win10v2004-20220812-en
General
-
Target
1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe
-
Size
392KB
-
MD5
20ce4574ada3574c4f031c0ae6f2d740
-
SHA1
18d4d4e5447209cbcb2dea8d6d1ed6e36bda22a1
-
SHA256
1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92
-
SHA512
4a79d92f4188bf1c58dfc61914f925f4b1eacda695a1f354f7d34ab4a0077019702d7ae62b25ad40ad628f8a634cc73becfc4f812e255e1458a1fe294aa006cc
-
SSDEEP
12288:zc//////ZACI3DORfSSpyhufy3DQ8rEkb:zc//////ZnI3DGfdyhufis8rr
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3544 set thread context of 1780 3544 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 79 -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1780 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 1780 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 1780 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3544 wrote to memory of 1780 3544 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 79 PID 3544 wrote to memory of 1780 3544 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 79 PID 3544 wrote to memory of 1780 3544 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 79 PID 3544 wrote to memory of 1780 3544 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 79 PID 3544 wrote to memory of 1780 3544 1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe"C:\Users\Admin\AppData\Local\Temp\1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exeC:\Users\Admin\AppData\Local\Temp\1a7b0b8b7c1a346fc9e9c65427fffe170fcfe3b29f9231dff853cc5d7d23ae92.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:1780
-