Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
57s -
max time network
180s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
15/05/2023, 03:53
Static task
static1
Behavioral task
behavioral1
Sample
5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe
Resource
win10-20230220-en
General
-
Target
5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe
-
Size
209KB
-
MD5
508bd7adb8979cb793d0770ccf30b532
-
SHA1
34e00766ec558163daa6d4c6db33197b410bb78a
-
SHA256
5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982
-
SHA512
c409d2c011497af79394285c4415c21e68db4c2a5ea90145ade11d29eda22c05d501fc618c801679f9d04954dd09cc349b174b591f94250097bdc60982377a4d
-
SSDEEP
3072:HeFJv/HExrlEdPg65om1U15UF7RgUyH3alTbxI:+Tv/HKlEdP3hIU5Cha8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-640001698-3754512395-3275565439-1000\Software\Microsoft\Windows\CurrentVersion\Run\SemenExe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Compot.exe" AppLaunch.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4404 set thread context of 1320 4404 5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe 67 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4404 wrote to memory of 1320 4404 5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe 67 PID 4404 wrote to memory of 1320 4404 5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe 67 PID 4404 wrote to memory of 1320 4404 5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe 67 PID 4404 wrote to memory of 1320 4404 5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe 67 PID 4404 wrote to memory of 1320 4404 5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe 67
Processes
-
C:\Users\Admin\AppData\Local\Temp\5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe"C:\Users\Admin\AppData\Local\Temp\5350b92396daac133e1326957cc47d7c7e7e4737a584e49062e78d516ab6a982.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Adds Run key to start application
PID:1320
-