Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    193s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/12/2022, 02:29

General

  • Target

    804df98fb01239be81b818a8c2a23b3b30b07e6b30c3cf0c14a37221dc7a37ef.exe

  • Size

    262KB

  • MD5

    3ad604e6da280b277fe7237eb0cf94ee

  • SHA1

    a58e25ccd124b6cefc49c185066406f6b37c793a

  • SHA256

    804df98fb01239be81b818a8c2a23b3b30b07e6b30c3cf0c14a37221dc7a37ef

  • SHA512

    c9a60eaefbdc932c72e5dd6107e6836bba0c97fa4c94323a5220184e2c18b04310670dbb55faa35154dde9e167aad988bd78f0a480500fabe3cbe2ef361005ec

  • SSDEEP

    6144:rVlWOtreUekfps+jF46iGqf3EEJEnKQ3edyBiqiDZOa2xov:rVZrACFRiGq/rez3edTz2

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\804df98fb01239be81b818a8c2a23b3b30b07e6b30c3cf0c14a37221dc7a37ef.exe
    "C:\Users\Admin\AppData\Local\Temp\804df98fb01239be81b818a8c2a23b3b30b07e6b30c3cf0c14a37221dc7a37ef.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3876
    • \??\c:\users\admin\appdata\local\temp\804df98fb01239be81b818a8c2a23b3b30b07e6b30c3cf0c14a37221dc7a37ef.exe
      "c:\users\admin\appdata\local\temp\804df98fb01239be81b818a8c2a23b3b30b07e6b30c3cf0c14a37221dc7a37ef.exe"
      2⤵
        PID:3276

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3276-133-0x0000000000400000-0x000000000043B000-memory.dmp

      Filesize

      236KB

    • memory/3276-135-0x0000000000400000-0x000000000043B000-memory.dmp

      Filesize

      236KB