Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2023, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
1.4MB
-
MD5
34517f9ebbfdc93ea5590bdff48b8c0b
-
SHA1
0b3bd7d712b9a620c862519b515d53636b19d0bb
-
SHA256
6ceb50da4275db929de139517ee96a5617ca2a8dead8db120d4f43a467f2fbf5
-
SHA512
86c66de198ba7ace57cf64fe28b4e5da567ea9ea52349d083b0b3ad730ee41afaa2e7558891fb18cf145de010dc9daaed0a3f17f684fbd3a6c199f06f020de67
-
SSDEEP
24576:z9Pdh1k8BKSPzr//PYp18m27hly2tjrPAU1th7ERmVts112HvUU9/JPrThakPTc:hPdhb9//M8/yEsCERL2HvUU7zFakPTc
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe 2796 tmp.exe