Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06/06/2023, 22:23
Behavioral task
behavioral1
Sample
init.exe
Resource
win10v2004-20230220-en
General
-
Target
init.exe
-
Size
8.3MB
-
MD5
1c4a6e39704dce85672b8a0ee76acac8
-
SHA1
692d626b54a634423732d3a3cdeae4664ccf9ebf
-
SHA256
0eefc17ee359f90ef231fd7b0abe70bf673862b57eeb07b0ae877b66a4787127
-
SHA512
866f9cc2f94416d7543cb290f1c7514e055014d0875ea66a36e50ce06bb6f87a419e3ac9f9dfab316027c130ee826a66c88461ec12d2b8b53d06e6064b17a304
-
SSDEEP
196608:4D+KrvPkteuYOjmFKJ4M6P9ByLpJwa072:+VzeeuXKBMIBmpSa0C
Malware Config
Signatures
-
Loads dropped DLL 18 IoCs
pid Process 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe 4896 init.exe -
resource yara_rule behavioral1/files/0x000600000002317d-163.dat upx behavioral1/files/0x000600000002317d-164.dat upx behavioral1/memory/4896-168-0x00007FFC6B530000-0x00007FFC6BB19000-memory.dmp upx behavioral1/files/0x000600000002317f-169.dat upx behavioral1/files/0x000600000002317f-173.dat upx behavioral1/files/0x0006000000023171-174.dat upx behavioral1/files/0x000600000002317e-176.dat upx behavioral1/files/0x0006000000023171-175.dat upx behavioral1/files/0x000600000002317e-177.dat upx behavioral1/files/0x0006000000023172-178.dat upx behavioral1/files/0x0006000000023172-179.dat upx behavioral1/files/0x000600000002317b-181.dat upx behavioral1/files/0x000600000002317a-180.dat upx behavioral1/files/0x000600000002317b-182.dat upx behavioral1/files/0x000600000002317a-184.dat upx behavioral1/files/0x000600000002317a-183.dat upx behavioral1/memory/4896-186-0x00007FFC7CEE0000-0x00007FFC7CEF9000-memory.dmp upx behavioral1/memory/4896-185-0x00007FFC80210000-0x00007FFC80220000-memory.dmp upx behavioral1/memory/4896-187-0x00007FFC7CBE0000-0x00007FFC7CBED000-memory.dmp upx behavioral1/memory/4896-188-0x00007FFC6CCC0000-0x00007FFC6CCEE000-memory.dmp upx behavioral1/memory/4896-189-0x00007FFC6CC00000-0x00007FFC6CCB8000-memory.dmp upx behavioral1/files/0x000600000002316e-190.dat upx behavioral1/memory/4896-193-0x00007FFC6C880000-0x00007FFC6CBF9000-memory.dmp upx behavioral1/files/0x0006000000023174-195.dat upx behavioral1/files/0x0006000000023170-194.dat upx behavioral1/files/0x0006000000023175-198.dat upx behavioral1/files/0x0006000000023175-197.dat upx behavioral1/files/0x0006000000023174-196.dat upx behavioral1/files/0x0006000000023170-192.dat upx behavioral1/files/0x000600000002316e-191.dat upx behavioral1/files/0x0006000000023180-199.dat upx behavioral1/files/0x0006000000023180-201.dat upx behavioral1/memory/4896-202-0x00007FFC76100000-0x00007FFC7610B000-memory.dmp upx behavioral1/files/0x000600000002316f-205.dat upx behavioral1/memory/4896-206-0x00007FFC6C850000-0x00007FFC6C874000-memory.dmp upx behavioral1/memory/4896-208-0x00007FFC6B290000-0x00007FFC6B3AC000-memory.dmp upx behavioral1/files/0x000600000002316f-207.dat upx behavioral1/files/0x000600000002316a-204.dat upx behavioral1/files/0x000600000002316a-203.dat upx behavioral1/memory/4896-213-0x00007FFC7C0A0000-0x00007FFC7C0B4000-memory.dmp upx behavioral1/memory/4896-214-0x00007FFC7CA70000-0x00007FFC7CA7D000-memory.dmp upx behavioral1/memory/4896-215-0x00007FFC6C830000-0x00007FFC6C849000-memory.dmp upx behavioral1/memory/4896-216-0x00007FFC6AF70000-0x00007FFC6AF9D000-memory.dmp upx behavioral1/memory/4896-217-0x00007FFC6B530000-0x00007FFC6BB19000-memory.dmp upx behavioral1/memory/4896-219-0x00007FFC7CEE0000-0x00007FFC7CEF9000-memory.dmp upx behavioral1/memory/4896-221-0x00007FFC6CCC0000-0x00007FFC6CCEE000-memory.dmp upx behavioral1/memory/4896-222-0x00007FFC6CC00000-0x00007FFC6CCB8000-memory.dmp upx behavioral1/memory/4896-223-0x00007FFC6C880000-0x00007FFC6CBF9000-memory.dmp upx -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3612 wrote to memory of 4896 3612 init.exe 85 PID 3612 wrote to memory of 4896 3612 init.exe 85
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
48KB
MD5d93494d8b15f82a7239152da4317738c
SHA1750551fb66e54095958789260eba07bc683d1eec
SHA256a9765376a387eebc94a188d72b7c60eeb34001ab207eae15352a433951b44bca
SHA51257268150835a3360e70d5d45dda4b8894e6ec438efd7bfbae2e94a5c42745c9725f8191b2ea33dd7772a80fe9424854c76a75e2bf41a4292cf566a54020f1a0d
-
Filesize
48KB
MD5d93494d8b15f82a7239152da4317738c
SHA1750551fb66e54095958789260eba07bc683d1eec
SHA256a9765376a387eebc94a188d72b7c60eeb34001ab207eae15352a433951b44bca
SHA51257268150835a3360e70d5d45dda4b8894e6ec438efd7bfbae2e94a5c42745c9725f8191b2ea33dd7772a80fe9424854c76a75e2bf41a4292cf566a54020f1a0d
-
Filesize
35KB
MD57e8bdc9ebafe727307664be2883fbbc1
SHA1a0609ddf9616d82ce147f452f26f53100a776b58
SHA2563606be88a4b0b3eed8b2c1599b08304276cc1338a760b59c38b11beb25ac16d9
SHA512db60010834213914f0366dc4a7cc96f39d44a5600675dad3760a2debba96854c1c4baba9389d3a85d0e286a0835a04df0e3825987622a12d66191fd1b6294cc6
-
Filesize
35KB
MD57e8bdc9ebafe727307664be2883fbbc1
SHA1a0609ddf9616d82ce147f452f26f53100a776b58
SHA2563606be88a4b0b3eed8b2c1599b08304276cc1338a760b59c38b11beb25ac16d9
SHA512db60010834213914f0366dc4a7cc96f39d44a5600675dad3760a2debba96854c1c4baba9389d3a85d0e286a0835a04df0e3825987622a12d66191fd1b6294cc6
-
Filesize
85KB
MD514406a6e97aa7bbc6c5b3ffe8d66eb72
SHA17f7cdea656e427b1fbdd58f9628db1a2b24b34ee
SHA25692bc0b51c9922c151953a7d286f751a1ad6a8be4c33fc3ab6ef8f29362f5da98
SHA512a6d221cd54862fbb966e814ae20b8efc97a430f50ae63dcd6b1f0a43de2b95e996b662c10f15720106ef8839b3a9be137f05f13dfc8f6602624dbee8bf5c6d06
-
Filesize
85KB
MD514406a6e97aa7bbc6c5b3ffe8d66eb72
SHA17f7cdea656e427b1fbdd58f9628db1a2b24b34ee
SHA25692bc0b51c9922c151953a7d286f751a1ad6a8be4c33fc3ab6ef8f29362f5da98
SHA512a6d221cd54862fbb966e814ae20b8efc97a430f50ae63dcd6b1f0a43de2b95e996b662c10f15720106ef8839b3a9be137f05f13dfc8f6602624dbee8bf5c6d06
-
Filesize
25KB
MD531b10478bc4a57f59e46cc6dd649767c
SHA17b29b247a93c853d2180245cf6832dd04f652c66
SHA256aac58d419336877e154ce48780a7f9c7d0c66170baa04c6acc090ef222640d5d
SHA5121a783e54d887defcb7ca1a82f6e454de4700acecef5b18c1a1ccc8ec44d5232430c8be442c6892fafd21ba0db171b333f9f6e6c45e6ad7c4507e87c100d7b902
-
Filesize
25KB
MD531b10478bc4a57f59e46cc6dd649767c
SHA17b29b247a93c853d2180245cf6832dd04f652c66
SHA256aac58d419336877e154ce48780a7f9c7d0c66170baa04c6acc090ef222640d5d
SHA5121a783e54d887defcb7ca1a82f6e454de4700acecef5b18c1a1ccc8ec44d5232430c8be442c6892fafd21ba0db171b333f9f6e6c45e6ad7c4507e87c100d7b902
-
Filesize
43KB
MD5b2358bb6290d013cefad0ce78172c6ac
SHA16396da821d54151e0210d3a255f4f6e3305102f7
SHA2569cf8f5a1a808ac5d313b1b06646abc3ffdf47ce14acbdb1fe93bd07039cd9be2
SHA512e7ba831053426afbe2a8137b6a13b3ad59415d5693c0b8cabfa05249f5c1f8a5d0666728141c79c2d9ebba9feb79cc389006f5a3900ce34ddd7563e0adfb0616
-
Filesize
43KB
MD5b2358bb6290d013cefad0ce78172c6ac
SHA16396da821d54151e0210d3a255f4f6e3305102f7
SHA2569cf8f5a1a808ac5d313b1b06646abc3ffdf47ce14acbdb1fe93bd07039cd9be2
SHA512e7ba831053426afbe2a8137b6a13b3ad59415d5693c0b8cabfa05249f5c1f8a5d0666728141c79c2d9ebba9feb79cc389006f5a3900ce34ddd7563e0adfb0616
-
Filesize
62KB
MD5732184a29212bcd8239e5bef55b2eb3d
SHA1696bd71999b1edc46b6a161dac9c08de447520d1
SHA2566036672ed2aef6dec52847ffb7b4b721a8f585f3dca88e44281d2daf6f6b769b
SHA512273d1551e96c9c77a1acaaaabfc23508981c175afd6d732f40756ced008ed964d7c004c3e8c8aaf538b924d8045d42b7ec45096d497f13cd9ed72bdb28564515
-
Filesize
62KB
MD5732184a29212bcd8239e5bef55b2eb3d
SHA1696bd71999b1edc46b6a161dac9c08de447520d1
SHA2566036672ed2aef6dec52847ffb7b4b721a8f585f3dca88e44281d2daf6f6b769b
SHA512273d1551e96c9c77a1acaaaabfc23508981c175afd6d732f40756ced008ed964d7c004c3e8c8aaf538b924d8045d42b7ec45096d497f13cd9ed72bdb28564515
-
Filesize
1.7MB
MD5ebb4f1a115f0692698b5640869f30853
SHA19ba77340a6a32af08899e7f3c97841724dd78c3f
SHA2564ab0deb6a298d14a0f50d55dc6ce5673b6c5320817ec255acf282191642a4576
SHA5123f6ba7d86c9f292344f4ad196f4ae863bf936578dd7cfac7dc4aaf05c2c78e68d5f813c4ed36048b6678451f1717deeb77493d8557ee6778c6a70beb5294d21a
-
Filesize
268KB
MD559a15f9a93dcdaa5bfca246b84fa936a
SHA17f295ea74fc7ed0af0e92be08071fb0b76c8509e
SHA2562c11c3ce08ffc40d390319c72bc10d4f908e9c634494d65ed2cbc550731fd524
SHA512746157a0fcedc67120c2a194a759fa8d8e1f84837e740f379566f260e41aa96b8d4ea18e967e3d1aa1d65d5de30453446d8a8c37c636c08c6a3741387483a7d7
-
Filesize
9KB
MD5e197c64233d5ff67de1771685d868e7e
SHA12c841807654f7bf131f43c22e3eda9e95a4427d3
SHA256269fb480bd1f029627f054b525211f49f976ffb89f5ddc9e7871bcf965975c06
SHA5122eb6af2ab4598aaba7741e78e5b37e1b91cc9c2616a8eb5891e23e5088051e1c8399404d4de25f0e3b8110dbd838be5d0d5cf3ae65faf0ade5d9eef595159100
-
Filesize
9KB
MD5e197c64233d5ff67de1771685d868e7e
SHA12c841807654f7bf131f43c22e3eda9e95a4427d3
SHA256269fb480bd1f029627f054b525211f49f976ffb89f5ddc9e7871bcf965975c06
SHA5122eb6af2ab4598aaba7741e78e5b37e1b91cc9c2616a8eb5891e23e5088051e1c8399404d4de25f0e3b8110dbd838be5d0d5cf3ae65faf0ade5d9eef595159100
-
Filesize
38KB
MD5d1ed02ac097ae0cf03cf8a7f62f70c9c
SHA181650020ce0df7ead1232b86b261b7be0f4dd82f
SHA256e62c33e895df9ee2ff7d421c706b893d694660043fd531931c0b9141b819ae34
SHA512dd35a539845f111988d23d74c792eb28e8bc02ce385e621b15ff27a732a7dd10e6923885068758222f1d5a57cdecec4633c0f53e01b727eff3a625a760ae3036
-
Filesize
38KB
MD5d1ed02ac097ae0cf03cf8a7f62f70c9c
SHA181650020ce0df7ead1232b86b261b7be0f4dd82f
SHA256e62c33e895df9ee2ff7d421c706b893d694660043fd531931c0b9141b819ae34
SHA512dd35a539845f111988d23d74c792eb28e8bc02ce385e621b15ff27a732a7dd10e6923885068758222f1d5a57cdecec4633c0f53e01b727eff3a625a760ae3036
-
Filesize
1.1MB
MD54edb3f0d95b2717a094aa0156cf5fe18
SHA146b7395c57e228411c3a29cfd5267a62581b214f
SHA256bc4359c134cc7bca1de4c8365cbcec6236d75c1b572ef97c4b59e2387144e83a
SHA51266b159d5ac54b604c452273ea76cc2cb1e2e0dfb71f18768010d6d86643ea3cf7d4cfbf5a2e5c3ff67d5773cf9ea7467e001b5e85aa9c92f0efa77abe0aa1d67
-
Filesize
1.1MB
MD54edb3f0d95b2717a094aa0156cf5fe18
SHA146b7395c57e228411c3a29cfd5267a62581b214f
SHA256bc4359c134cc7bca1de4c8365cbcec6236d75c1b572ef97c4b59e2387144e83a
SHA51266b159d5ac54b604c452273ea76cc2cb1e2e0dfb71f18768010d6d86643ea3cf7d4cfbf5a2e5c3ff67d5773cf9ea7467e001b5e85aa9c92f0efa77abe0aa1d67
-
Filesize
1.1MB
MD54edb3f0d95b2717a094aa0156cf5fe18
SHA146b7395c57e228411c3a29cfd5267a62581b214f
SHA256bc4359c134cc7bca1de4c8365cbcec6236d75c1b572ef97c4b59e2387144e83a
SHA51266b159d5ac54b604c452273ea76cc2cb1e2e0dfb71f18768010d6d86643ea3cf7d4cfbf5a2e5c3ff67d5773cf9ea7467e001b5e85aa9c92f0efa77abe0aa1d67
-
Filesize
204KB
MD5fe32b4e972e3cb418a397461ae3a646c
SHA1bc28e4538f920d7601455a5171e43eb2820be41a
SHA25665f20fca13e614bbcedf1445fe521b5f9a3fbc2895e0b28dde73d5d33406a38b
SHA51236e35f440e7e6a7737d7c55266639709580167c38661fad6017b94deb339d67bec469edd6d29b61d1a3d56138685df76b73713c75b192df690d8108e5caa0dfd
-
Filesize
204KB
MD5fe32b4e972e3cb418a397461ae3a646c
SHA1bc28e4538f920d7601455a5171e43eb2820be41a
SHA25665f20fca13e614bbcedf1445fe521b5f9a3fbc2895e0b28dde73d5d33406a38b
SHA51236e35f440e7e6a7737d7c55266639709580167c38661fad6017b94deb339d67bec469edd6d29b61d1a3d56138685df76b73713c75b192df690d8108e5caa0dfd
-
Filesize
65KB
MD57442c154565f1956d409092ede9cc310
SHA1c72f9c99ea56c8fb269b4d6b3507b67e80269c2d
SHA25695086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
SHA5122bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844
-
Filesize
65KB
MD57442c154565f1956d409092ede9cc310
SHA1c72f9c99ea56c8fb269b4d6b3507b67e80269c2d
SHA25695086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
SHA5122bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844
-
Filesize
65KB
MD57442c154565f1956d409092ede9cc310
SHA1c72f9c99ea56c8fb269b4d6b3507b67e80269c2d
SHA25695086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
SHA5122bf96828534bcdf71e48d1948b989011d8e3ba757c38cc17905a13d3021ea5deb57e2c68d79507a6acbb62be009cfc85b24d14543958dba1d3bc3e4ca7d4f844
-
Filesize
1.6MB
MD5bd41a26e89fc6bc661c53a2d4af35e3e
SHA18b52f7ab62ddb8c484a7da16efad33ce068635f6
SHA2563cded5180dca1015347fd6ea44dbcc5ddd050adc7adbb99cf2991032320a5359
SHA512b8dafc262d411e1c315754be4901d507893db04ea2d3f4b71cbdd0dab25d27f9274e7faf85ac880c85522d24fa57da06019c5910622003a305914cf8884ad02f
-
Filesize
1.6MB
MD5bd41a26e89fc6bc661c53a2d4af35e3e
SHA18b52f7ab62ddb8c484a7da16efad33ce068635f6
SHA2563cded5180dca1015347fd6ea44dbcc5ddd050adc7adbb99cf2991032320a5359
SHA512b8dafc262d411e1c315754be4901d507893db04ea2d3f4b71cbdd0dab25d27f9274e7faf85ac880c85522d24fa57da06019c5910622003a305914cf8884ad02f
-
Filesize
25KB
MD5ca2f76d9e63a8f9ebcbba11fe8438231
SHA16a1824554baacc5771c02c358286ba660f7e00a7
SHA256db2723d473510f66c81366436fe2e9399b42b6e02da31a8800101f37da3093c0
SHA512ed64407e44ad9ed16f4ba7dc86ccaf834c3e53a11dbe4459655ddbb9461ddeea4e14febf1086eb3f19b89d40c03fee06190c1cec9292626228b33886a1f00d9e
-
Filesize
25KB
MD5ca2f76d9e63a8f9ebcbba11fe8438231
SHA16a1824554baacc5771c02c358286ba660f7e00a7
SHA256db2723d473510f66c81366436fe2e9399b42b6e02da31a8800101f37da3093c0
SHA512ed64407e44ad9ed16f4ba7dc86ccaf834c3e53a11dbe4459655ddbb9461ddeea4e14febf1086eb3f19b89d40c03fee06190c1cec9292626228b33886a1f00d9e
-
Filesize
17KB
MD5e058c833777e27d6b46a4aa4244f840a
SHA1f3e144cee4fcaa09f7c0f7a2f1d124b3740f95e9
SHA25672d221dc53979820e152436b1fff307ba55a9f8fd3b208645b6b52c3676dd64e
SHA51229680311bd40ecd85db6d1727852005ab44c48475e80cc28a5eb2f7d879d28b6c0b43f11fce67432b4aa34da2c31804fce5dea2f2657854997c43702b67d4a85
-
Filesize
17KB
MD5e058c833777e27d6b46a4aa4244f840a
SHA1f3e144cee4fcaa09f7c0f7a2f1d124b3740f95e9
SHA25672d221dc53979820e152436b1fff307ba55a9f8fd3b208645b6b52c3676dd64e
SHA51229680311bd40ecd85db6d1727852005ab44c48475e80cc28a5eb2f7d879d28b6c0b43f11fce67432b4aa34da2c31804fce5dea2f2657854997c43702b67d4a85
-
Filesize
295KB
MD5c28e16246d294440ad615e235e66da0d
SHA11cb86a41d8e52dcb90fabaddaa7df5d425851abf
SHA2563189e4c8d66e203583de419e9d5e4b12b7f8034bafe3d22bb7ddc3e6705ae8dc
SHA51232f9af74b33c5ed6c2315905300c7af070bc91ba974b08a0260dfa2bbb763fc1e3358699e864edcd4bbab73f76b836d3013be6301320f164e545badf7908096b
-
Filesize
295KB
MD5c28e16246d294440ad615e235e66da0d
SHA11cb86a41d8e52dcb90fabaddaa7df5d425851abf
SHA2563189e4c8d66e203583de419e9d5e4b12b7f8034bafe3d22bb7ddc3e6705ae8dc
SHA51232f9af74b33c5ed6c2315905300c7af070bc91ba974b08a0260dfa2bbb763fc1e3358699e864edcd4bbab73f76b836d3013be6301320f164e545badf7908096b