Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
290s -
max time network
318s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 01:00
Static task
static1
Behavioral task
behavioral1
Sample
8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe
Resource
win10v2004-20221111-en
General
-
Target
8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe
-
Size
1.2MB
-
MD5
055228ce73b0cade11fb3c292f42f784
-
SHA1
d2c557d1cf011d147a011a2b89c832e2f7d638db
-
SHA256
8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95
-
SHA512
1373df87e64c6de42c079363f2ba86a97bd770edae5ac4c7f1526d57847645508cb9bee1e564089903a98f024e388a8f2bf777be3bad9b42117d6141ea1e8f1d
-
SSDEEP
24576:6MdktVSlvog5hp3gzBCsX1lq7xHZB0bTcpg9ZgYejEzOWa03NHI68mB:6MdkS6IsXkRX0bQEgYe709hH
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4312 set thread context of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1100 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 1100 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 1100 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 1100 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 1100 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80 PID 4312 wrote to memory of 1100 4312 8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe"C:\Users\Admin\AppData\Local\Temp\8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\8fb1c4cfbdd46fef9e6724d9d69ae22400ce1bb02c5f5a7e0d3cb511dc09da95.exe
- Suspicious use of SetWindowsHookEx
PID:1100
-