Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/03/2023, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
7bd1a2a1fd806ddb2b2e18a761fa7dfd328b7435c15325df93698f0f96990e23.exe
Resource
win7-20230220-en
General
-
Target
7bd1a2a1fd806ddb2b2e18a761fa7dfd328b7435c15325df93698f0f96990e23.exe
-
Size
832KB
-
MD5
859237f02c68587d74445a32baae2d82
-
SHA1
793948af2df828971b94281ac86002d78faf783c
-
SHA256
7bd1a2a1fd806ddb2b2e18a761fa7dfd328b7435c15325df93698f0f96990e23
-
SHA512
fb4af0d8319d46a8b361136b01aacc9077e9ee4ed63c571e2d8bcdc3c196f3f48bcdc35fd143d0b4afb3839b72def317f1c73b52e9629ce46b71b00c703ba14c
-
SSDEEP
12288:0+leo/RI0uDrvCESpKEtxydXfbYtpIl039oSXsj:BlD/K0evZSntxylDspgqy
Malware Config
Signatures
-
Contacts a large (1275) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
resource yara_rule behavioral2/memory/2860-133-0x0000000010000000-0x000000001006C000-memory.dmp upx behavioral2/memory/2860-144-0x0000000010000000-0x000000001006C000-memory.dmp upx behavioral2/memory/2860-146-0x0000000010000000-0x000000001006C000-memory.dmp upx -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2860 7bd1a2a1fd806ddb2b2e18a761fa7dfd328b7435c15325df93698f0f96990e23.exe 2860 7bd1a2a1fd806ddb2b2e18a761fa7dfd328b7435c15325df93698f0f96990e23.exe