Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 11:54
Behavioral task
behavioral1
Sample
ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe
Resource
win10v2004-20220812-en
General
-
Target
ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe
-
Size
961KB
-
MD5
456fe0e964a4a48c6aae1893232b495c
-
SHA1
0757738f4f6d9ba4a974cb41a24796179e2779b2
-
SHA256
ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23
-
SHA512
676cbc126fb71f6e40411b25b8600bc6786d94d3c36ed03972c11ae0319cf37f004d8db81a3dbfa091e2010602b6949dbe78efaa6c98266c136c589035e67b72
-
SSDEEP
24576:LUbIaDWwJ41fE5nWVIwwgjrRByjrYw0zbw2QKkUtV:LUbIaYCPQj9ByPYw0zfQMt
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/944-132-0x0000000000400000-0x0000000000716000-memory.dmp upx behavioral2/memory/944-133-0x0000000000400000-0x0000000000716000-memory.dmp upx behavioral2/memory/944-134-0x0000000000400000-0x0000000000716000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 944 ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe 944 ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 944 ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe 944 ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 944 ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe 944 ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe"C:\Users\Admin\AppData\Local\Temp\ab375a988c9a693a5efbe6600d17006696f4c10e8bdfd9925464725f0219fa23.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:944