Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
307s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28/11/2022, 03:42
Static task
static1
Behavioral task
behavioral1
Sample
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
Resource
win10v2004-20221111-en
General
-
Target
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
-
Size
196KB
-
MD5
7c401bde8cafc5b745b9f65effbd588f
-
SHA1
b5691ee02fb8560e6143785087ce465e0c88cf08
-
SHA256
47b2a9c7db77b6cd600ffaa2f4691cd772c1a703477b9906942ceda5fb2edb0d
-
SHA512
10cf7eaf9da0692f91ae8f8a42a970c9083605440c733ff8220f5f9d3783c74e0c94713e83a9b0341289a30d23ba843a18a828601e4d2699ad8b1fe0ea1be3a1
-
SSDEEP
3072:tj6nX6bQwg4p5d5LSJ0NpCkvYIwrcixkqelXjChTW3JbbeGI6Ja:90qcw6wKIgcixClzChKoGLa
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4248 set thread context of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 4248 wrote to memory of 2636 4248 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 81 PID 2636 wrote to memory of 3980 2636 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 82 PID 2636 wrote to memory of 3980 2636 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 82 PID 2636 wrote to memory of 3980 2636 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeC:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6704~1.BAT"3⤵PID:3980
-
-