Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
30/05/2023, 23:39
Behavioral task
behavioral1
Sample
Permanent_Loader.exe
Resource
win10-20230220-en
6 signatures
150 seconds
General
-
Target
Permanent_Loader.exe
-
Size
5.1MB
-
MD5
adafde1dc3ab8eecd5e611cf6427dbf5
-
SHA1
424245983e0996571c989f6d6f5236702fda800e
-
SHA256
6c716a49ea22e7d028ccde485d5c4ddc236369c9b60eedd3602d0172d42a5b9c
-
SHA512
ad418c58ab787934b42420a5c43e0066f2732d5c9594f21496013931aaddca77bb4f39547dd7eb02e1aad3330d573bae72abf3e57cb4341e81da53f0e661b58d
-
SSDEEP
98304:eq/WT/VbNl7PAk96LpTVfCjENZvSHj/F9gY2lF/N:5uNndALpVfCj68Hx9l2L1
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/3584-119-0x0000000140000000-0x00000001408D9000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3584 Permanent_Loader.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3140 3584 WerFault.exe 65 -
Delays execution with timeout.exe 1 IoCs
pid Process 3132 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3584 Permanent_Loader.exe 3584 Permanent_Loader.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3584 wrote to memory of 368 3584 Permanent_Loader.exe 67 PID 3584 wrote to memory of 368 3584 Permanent_Loader.exe 67 PID 368 wrote to memory of 4396 368 cmd.exe 68 PID 368 wrote to memory of 4396 368 cmd.exe 68 PID 368 wrote to memory of 2180 368 cmd.exe 69 PID 368 wrote to memory of 2180 368 cmd.exe 69 PID 368 wrote to memory of 2172 368 cmd.exe 70 PID 368 wrote to memory of 2172 368 cmd.exe 70 PID 3584 wrote to memory of 1804 3584 Permanent_Loader.exe 71 PID 3584 wrote to memory of 1804 3584 Permanent_Loader.exe 71 PID 1804 wrote to memory of 4116 1804 cmd.exe 72 PID 1804 wrote to memory of 4116 1804 cmd.exe 72 PID 4116 wrote to memory of 3132 4116 cmd.exe 75 PID 4116 wrote to memory of 3132 4116 cmd.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\Permanent_Loader.exe"C:\Users\Admin\AppData\Local\Temp\Permanent_Loader.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Permanent_Loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Permanent_Loader.exe" MD53⤵PID:4396
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2180
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2172
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Couldn't resolve host name && timeout /t 5"2⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo Couldn't resolve host name && timeout /t 5"3⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:3132
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3584 -s 14482⤵
- Program crash
PID:3140
-