Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    322s
  • max time network
    382s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 21:05

General

  • Target

    5ccc7dac021af7551dcd3715eeb5e1a2095d823d6044a63f5b83e59ea1e2087c.exe

  • Size

    323KB

  • MD5

    b16f784cfeb39e3aae32706cc12f3cad

  • SHA1

    909bcc04aad342462e489db69ddb7078ea56a249

  • SHA256

    5ccc7dac021af7551dcd3715eeb5e1a2095d823d6044a63f5b83e59ea1e2087c

  • SHA512

    89ec937d34dfce008387e0669332c0b92bdf10e1a1e16f2b85b3c2c32b0d57751df66000bb4daaa21dbe8d4f061470c8b388cd31314d955d247d051392b35445

  • SSDEEP

    6144:bzWSRKXnr0ISPlkai1sU0NrI/Gd6FXw0Z:tRinr0ISPlkasZ0NuGdP0Z

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ccc7dac021af7551dcd3715eeb5e1a2095d823d6044a63f5b83e59ea1e2087c.exe
    "C:\Users\Admin\AppData\Local\Temp\5ccc7dac021af7551dcd3715eeb5e1a2095d823d6044a63f5b83e59ea1e2087c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:896
    • C:\Users\Admin\AppData\Local\Temp\5ccc7dac021af7551dcd3715eeb5e1a2095d823d6044a63f5b83e59ea1e2087c.exe
      "C:\Users\Admin\AppData\Local\Temp\5ccc7dac021af7551dcd3715eeb5e1a2095d823d6044a63f5b83e59ea1e2087c.exe"
      2⤵
        PID:3980

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/896-132-0x0000000002190000-0x000000000220B000-memory.dmp

      Filesize

      492KB

    • memory/896-136-0x0000000002190000-0x000000000220B000-memory.dmp

      Filesize

      492KB

    • memory/3980-134-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

    • memory/3980-137-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB