Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
179s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe
Resource
win10v2004-20221111-en
General
-
Target
c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe
-
Size
83KB
-
MD5
dd36952eb62212ade08d077514f4a2f8
-
SHA1
357a3553aa48a62a89bbe497715991d1c8c7c030
-
SHA256
c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248
-
SHA512
6a55da6f24ca2e61b5d8ee687af3914c97255cbcbe8dfedc2646478d454bc4948d0d7d5a798eda4c2c6e438d4f7819b46be3fab3ea97071a064087ed41f8385d
-
SSDEEP
1536:kCTQXgxb546muCpqk/avvuLU8YBkF+RL8nYs/Re:0eb546VYZ82LsSF+RIl/Re
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5048-136-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/memory/5048-139-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/memory/5048-140-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/memory/5048-142-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral2/memory/5048-143-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5048 c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2148 wrote to memory of 5048 2148 c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe 83 PID 2148 wrote to memory of 5048 2148 c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe 83 PID 2148 wrote to memory of 5048 2148 c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe"C:\Users\Admin\AppData\Local\Temp\c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\c52d4ec4e7ae4c553fc59a90d981a003927e6477561030060ace7c230194e248.exe?2⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5048
-