Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    181s
  • max time network
    307s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 03:42

General

  • Target

    RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe

  • Size

    196KB

  • MD5

    7c401bde8cafc5b745b9f65effbd588f

  • SHA1

    b5691ee02fb8560e6143785087ce465e0c88cf08

  • SHA256

    47b2a9c7db77b6cd600ffaa2f4691cd772c1a703477b9906942ceda5fb2edb0d

  • SHA512

    10cf7eaf9da0692f91ae8f8a42a970c9083605440c733ff8220f5f9d3783c74e0c94713e83a9b0341289a30d23ba843a18a828601e4d2699ad8b1fe0ea1be3a1

  • SSDEEP

    3072:tj6nX6bQwg4p5d5LSJ0NpCkvYIwrcixkqelXjChTW3JbbeGI6Ja:90qcw6wKIgcixClzChKoGLa

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
    "C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
      C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6704~1.BAT"
        3⤵
          PID:3980

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2540-139-0x00007FFC86790000-0x00007FFC867A0000-memory.dmp

      Filesize

      64KB

    • memory/2636-133-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2636-136-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2636-137-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/2636-140-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/4248-134-0x0000000000710000-0x0000000000714000-memory.dmp

      Filesize

      16KB