Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2022, 17:31
Static task
static1
Behavioral task
behavioral1
Sample
27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe
Resource
win10v2004-20221111-en
General
-
Target
27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe
-
Size
1.3MB
-
MD5
b87985cd4869b5cb789909afba6aa0d8
-
SHA1
8769a334aa622169cf9859a0f014e6c386959aa6
-
SHA256
27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612
-
SHA512
ca36c988638808a2f44b72bbda4d45ed284b1dc23bb256ff121d3b3f2e906406c75a36985158279db321202c943973b89d322e6f3529edfc6d613960e591d9b3
-
SSDEEP
24576:kKyKz4D4ufmwhzA2QoPKCys7JdpmnMlxy9KR8uQcu:kKVzMNuwIKyoBmnMSURNQ
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3372 set thread context of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4664 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 4664 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 4664 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 4664 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 4664 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84 PID 3372 wrote to memory of 4664 3372 27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe"C:\Users\Admin\AppData\Local\Temp\27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\27594698d9f4ef2eff5d07b751e11625fb485c181c041645066617d55c0c6612.exe
- Suspicious use of SetWindowsHookEx
PID:4664
-