Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    185s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 08:36

General

  • Target

    9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe

  • Size

    70KB

  • MD5

    bf9134c1b611f58d180b763769e86cf4

  • SHA1

    0e097a9b6d7710ad490f68c40684986df2b850f2

  • SHA256

    9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff

  • SHA512

    164a287ab6f296767a1cebcbc88ffea75b20e5d5875452845e329699c80141e9d983e5b65162141674ff9f244f07468ff5b2e5053eaddac3280fcdf2c45ae1c1

  • SSDEEP

    1536:HqiN2G50ffaX+Hv99DJYL2TvQJBAUFkDegvNeFjm0AJMR:Kk350XbHFzjTvScegvqjS+

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
    "C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
      C:\Users\Admin\AppData\Local\Temp\9b99133b06c6c6bf8f7e702b0828f8dff7246e2d5a31749255e894d971eab3ff.exe
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1476-138-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/1476-134-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/3288-141-0x0000000000590000-0x00000000005A0000-memory.dmp

    Filesize

    64KB

  • memory/3288-136-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3288-140-0x0000000000580000-0x0000000000590000-memory.dmp

    Filesize

    64KB

  • memory/3288-139-0x0000000000570000-0x0000000000580000-memory.dmp

    Filesize

    64KB

  • memory/3288-142-0x00000000005A0000-0x00000000005B0000-memory.dmp

    Filesize

    64KB

  • memory/3288-143-0x00000000005B0000-0x00000000005C0000-memory.dmp

    Filesize

    64KB

  • memory/3288-144-0x00000000006D0000-0x00000000006E0000-memory.dmp

    Filesize

    64KB

  • memory/3288-145-0x0000000002080000-0x0000000002090000-memory.dmp

    Filesize

    64KB

  • memory/3288-146-0x0000000002090000-0x00000000020A0000-memory.dmp

    Filesize

    64KB

  • memory/3288-147-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/3288-148-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB