Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 17:27
Static task
static1
Behavioral task
behavioral1
Sample
b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe
Resource
win10v2004-20220812-en
General
-
Target
b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe
-
Size
168KB
-
MD5
67fddea6b7b86cac62a7e6d7f5a55b67
-
SHA1
cf304677b229f9b3e325589d1055ed39263bdac5
-
SHA256
b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3
-
SHA512
083db64e3f134ed4345b51022c18ec7f34326b596fa5326d63bb4d6636bbb20f133c7cdf425e12db5a495f954371c418a795a107e2ea45ed5980ad1391989487
-
SSDEEP
3072:xy1Gzad4T9y3Wey+Ae8cT/38O6/smQLhZSRSRZDeejBmY9gB5HraZbWJGremk:xJzcm9hnncd6VQLLSkRdeejBnIkZbuGS
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2424 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe 67 PID 2176 wrote to memory of 2424 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe 67 PID 2176 wrote to memory of 2424 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe 67 PID 2176 wrote to memory of 2424 2176 b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe 67
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe"C:\Users\Admin\AppData\Local\Temp\b8e2dbd99c431b10ed70ad10f2738d9ae0ae32dfc419d75e7e2a60c6f4460fa3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176
-