Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 06:40
Behavioral task
behavioral1
Sample
f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe
-
Size
370KB
-
MD5
0db743291d1567bd256e8680035ee2a6
-
SHA1
92c11236119252116e8ad4e35355fe2f62dfecf1
-
SHA256
f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2
-
SHA512
222b86bee3be1d8f3ec896448db785858f68686c3f9843ed0dfdc17be0cdc7228d8a9796a436821b4748a53ebea739a98746c24bd5fe7dc30ab230f3faea22d8
-
SSDEEP
6144:eu0+UPcxN3y/tmlzJkMMevkt/TjMqky6KPzjnwoS:VKm3Ymlu/euPMqkyQoS
Score
8/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4248-132-0x0000000000400000-0x000000000051B000-memory.dmp upx behavioral2/memory/4248-133-0x0000000000400000-0x000000000051B000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mydri.sys f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe File opened for modification C:\Windows\SysWOW64\mydri.sys f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 632 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe 4248 f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe"C:\Users\Admin\AppData\Local\Temp\f1fd9c89c48922d9690dad8d41fc6bd878afac3ba8798ad10bed3dc42e6805c2.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4248