Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 16:32

General

  • Target

    df64c0ffb94e3a6cd49b6a33c0097c04fced0e1d68e5587b0b9e203ccca65d03.exe

  • Size

    109KB

  • MD5

    a8dc9c1d8f316135b196e2a1107aa546

  • SHA1

    6d391600582d774618866b3c5ca4dcf16c4ee873

  • SHA256

    df64c0ffb94e3a6cd49b6a33c0097c04fced0e1d68e5587b0b9e203ccca65d03

  • SHA512

    85d2c8ad3cb84655889a6471e39a10de0388d850af48e5fcfb6901d21e37add1eecddd70009eb4d272e3b4374353c22e815211aa374ddc3484e146cc2d7a569e

  • SSDEEP

    1536:x9DTJM8gpLCYsqJslqhGhgpWa4vVLC0aEhR+0DTYGOAqHzefobMmDGkaJgrPyKC3:PJxgpJsuN0mWiTa8ASCfohGkCYPb2

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\df64c0ffb94e3a6cd49b6a33c0097c04fced0e1d68e5587b0b9e203ccca65d03.exe
    "C:\Users\Admin\AppData\Local\Temp\df64c0ffb94e3a6cd49b6a33c0097c04fced0e1d68e5587b0b9e203ccca65d03.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Users\Admin\AppData\Local\Temp\df64c0ffb94e3a6cd49b6a33c0097c04fced0e1d68e5587b0b9e203ccca65d03.exe
      C:\Users\Admin\AppData\Local\Temp\df64c0ffb94e3a6cd49b6a33c0097c04fced0e1d68e5587b0b9e203ccca65d03.exe
      2⤵
        PID:908

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/908-55-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/908-56-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/908-58-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/908-60-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/908-59-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/908-62-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/908-65-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/908-68-0x0000000000400000-0x000000000041C000-memory.dmp

      Filesize

      112KB

    • memory/1060-54-0x0000000075021000-0x0000000075023000-memory.dmp

      Filesize

      8KB