Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/11/2022, 08:17
Static task
static1
Behavioral task
behavioral1
Sample
68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe
Resource
win10v2004-20220812-en
General
-
Target
68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe
-
Size
103KB
-
MD5
e324470374d130c5f497e3419880977a
-
SHA1
bb8b205cddb2dd55ecf6fdcae633bb8baf87b54b
-
SHA256
68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2
-
SHA512
fc52c5d40a27768f991457010e618cc004f29fe9fcadc2c91349a0a08690c53efa88bfa59d055c5ed15c03d39c2b26c512a7411f2b5b9da52f6ad9a5a3a1e731
-
SSDEEP
3072:5qt/NGGYMfhTWWxiLjNT3C6uW5SGnq+ENLOUpx:5qtoXShTWn+aPy
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4824 set thread context of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4824 wrote to memory of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81 PID 4824 wrote to memory of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81 PID 4824 wrote to memory of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81 PID 4824 wrote to memory of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81 PID 4824 wrote to memory of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81 PID 4824 wrote to memory of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81 PID 4824 wrote to memory of 4108 4824 68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe"C:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exeC:\Users\Admin\AppData\Local\Temp\68932fa9a7f553f01e35e69c82768fd88b89a1b850d3a93f2a52001a34c916d2.exe2⤵PID:4108
-