Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
16s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 04:24
Static task
static1
Behavioral task
behavioral1
Sample
rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
Resource
win10v2004-20221111-en
General
-
Target
rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe
-
Size
196KB
-
MD5
03c97952e19ce93941404ef9a3a935f5
-
SHA1
ec7edb6a0b5f14c7017ba645e269c8598633e384
-
SHA256
e01e77a43a43d919359d7716fc19c6286eaadf08cbec4442741789bd680594a0
-
SHA512
713b638f2f4f0870798ae66e14a81de302612b8aec3dc4cb1ce169b6df9be3aa89746dae4b31b0cd98ada46bd0fda3e42c8b4992c04ef6635bd112a137339f7f
-
SSDEEP
3072:9udusODvGZVHhX1drkr3k1qusMrf/Kf2DWJEi/i0D2D7oyCT8nVn1QJsYvVnGd+z:59+phXzpsML/E2DH0yDTV13Y5z
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1560 set thread context of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 4156 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 4156 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4156 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 1560 wrote to memory of 4156 1560 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 84 PID 4156 wrote to memory of 5088 4156 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 85 PID 4156 wrote to memory of 5088 4156 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 85 PID 4156 wrote to memory of 5088 4156 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 85 PID 4156 wrote to memory of 2584 4156 rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe 49
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exeC:\Users\Admin\AppData\Local\Temp\rechnung_november_2014_0003900028_2014_11_0029302375471_03_444_0039938289.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6188~1.BAT"4⤵PID:5088
-
-
-