Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2022, 03:35 UTC
Static task
static1
Behavioral task
behavioral1
Sample
ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
Resource
win10v2004-20220901-en
General
-
Target
ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
-
Size
1.3MB
-
MD5
c1cb427084b533db0617fcfbb952e8cb
-
SHA1
b199837836b67bcb6a5002279f76287de928dde5
-
SHA256
ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458
-
SHA512
0c7b06de99e76c0a11157891ed0cdb7629a751cabad9ccb76c397403577a74f9c2730bed177c04438ab4da92b0486401858a37018ac24131e465a84780eff792
-
SSDEEP
24576:TrKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakb:TrKo4ZwCOnYjVmJPaM
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4884 set thread context of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1712 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 1712 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 1712 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 1712 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 1712 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83 PID 4884 wrote to memory of 1712 4884 ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe"C:\Users\Admin\AppData\Local\Temp\ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\ef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
-
Remote address:8.8.8.8:53Requestuyu1bj1lhnrk.mxp2398.comIN AResponse
-
Remote address:8.8.8.8:53Requestuyu1bj1lhnrk.mxp2398.comIN AResponse
-
Remote address:8.8.8.8:53Request15.89.54.20.in-addr.arpaIN PTRResponse
-
92 B 80 B 2 2
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
322 B 7
-
8.8.8.8:53uyu1bj1lhnrk.mxp2398.comdnsef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe70 B 143 B 1 1
DNS Request
uyu1bj1lhnrk.mxp2398.com
-
8.8.8.8:53uyu1bj1lhnrk.mxp2398.comdnsef48e1371e04f6e4ec015a7df2a67a053975143c99286d8c5502e38059e35458.exe70 B 143 B 1 1
DNS Request
uyu1bj1lhnrk.mxp2398.com
-
70 B 156 B 1 1
DNS Request
15.89.54.20.in-addr.arpa