Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe
Resource
win10v2004-20220812-en
General
-
Target
caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe
-
Size
188KB
-
MD5
36b812c29506a9a9c12f02b8bb3e2035
-
SHA1
8d0b6a1805e8dd9a03bcacdf051126e950b2b2ea
-
SHA256
caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4
-
SHA512
2234d67c3420b04d25bc65a7917fa4de0e71709abe5e963d22781469c49b5449901047b6e4fd0107d3ecb8395e19c45602f06bf493e4aa33c405a3cc8dc18f19
-
SSDEEP
3072:uOddOZKczNR02NaiDCxcikVJ8DSmMDf1VZ11QaW0yuCU:Dd4z6ieWVuDzMLlTxW0yg
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4432 set thread context of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4972 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.EXE 4972 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4972 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76 PID 4432 wrote to memory of 4972 4432 caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe"C:\Users\Admin\AppData\Local\Temp\caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.EXE"C:\Users\Admin\AppData\Local\Temp\caff9093a9b21a339e1b180ed29488611de1021e7fd66fe25799fe2de440aef4.EXE"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-