Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2023, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
13466b8937f308d44a934e576cfc3075.bin.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
13466b8937f308d44a934e576cfc3075.bin.exe
Resource
win10v2004-20230703-en
General
-
Target
13466b8937f308d44a934e576cfc3075.bin.exe
-
Size
2.0MB
-
MD5
13466b8937f308d44a934e576cfc3075
-
SHA1
2c62e7187b10abcf18dfaaab72177e271b7a7b7d
-
SHA256
bc22a0e87e9ffae8c2aa04a35879be6f5fbef9da24897b9c00ea0fa28ae7a5f5
-
SHA512
b2a80e0811a6e6194388ca6d875e8e55b02c1151696f8641ab131af6be3b0931b4484da142ce313d65088ea15aaec625c47ca622912762b62b869553aab7c435
-
SSDEEP
49152:hkQTA2oTmoJqPuV24D7ViZRaQ6xn4px43Bo60mUgoe:ha2sRJ8uf3Vi+QY4px43Bo3mUgoe
Malware Config
Signatures
-
.NET Reactor proctector 33 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule behavioral2/memory/2240-136-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-137-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-139-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-141-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-143-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-145-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-147-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-149-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-151-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-153-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-155-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-157-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-159-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-161-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-163-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-165-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-167-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-169-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-171-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-173-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-175-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-177-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-179-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-181-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-183-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-185-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-187-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-189-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-191-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-193-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-195-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-197-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor behavioral2/memory/2240-199-0x0000000005360000-0x000000000569F000-memory.dmp net_reactor -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2240 13466b8937f308d44a934e576cfc3075.bin.exe