Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
Resource
win10v2004-20220812-en
General
-
Target
f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe
-
Size
578KB
-
MD5
0c30020a053f51cc33f33478462ad940
-
SHA1
8727ce1bb86a1038ae26395e2f9fe99a51559d4e
-
SHA256
f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121
-
SHA512
6d2161a8aa35f765e997c9b65fa39d0e892ed50a1bab1e86300061e5349b2f07caa6f75cd90b663584fa2efd9c1d1631692624509abc82a08e509eed3362b527
-
SSDEEP
12288:mRHQGHVgQvJr4X5f/0Q0nTzcBSl9YqbfhIM66Ci:qB3h4x0MwliyEE
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1748 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 4384 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 4052 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1748 wrote to memory of 4384 1748 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 80 PID 1748 wrote to memory of 4384 1748 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 80 PID 1748 wrote to memory of 4384 1748 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 80 PID 1748 wrote to memory of 4052 1748 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 81 PID 1748 wrote to memory of 4052 1748 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 81 PID 1748 wrote to memory of 4052 1748 f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe"C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exestart2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\f2e15acf6e9f25ca213eb1f12506cdbcf5df47c2b14f9eb5c3dc79fb57000121.exewatch2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4052
-