Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2023, 03:51
Static task
static1
Behavioral task
behavioral1
Sample
9269.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9269.exe
Resource
win10v2004-20230703-en
General
-
Target
9269.exe
-
Size
1.4MB
-
MD5
711d8682ec215e6ec5fdbf6acc10240e
-
SHA1
1786859b2ac480ff5698fad981aec52873b9f21a
-
SHA256
b245325d21b53f21ee7d6a1a8ed3963fcb89cf9770c3d0476ca0544558eaabc3
-
SHA512
77b68a54d52b03df21514200b6f34f68b3273e8024f4e528003ea4093fd7f4d3a099962a59283def4e4eadfd7f47eb7c4d798b9215e91f5c2178f66c952083e0
-
SSDEEP
24576:hXNLeml1gXxVn/r5zmscdv5mQ5UOBrI5fTveb/Jz28wXTJvdx:hXZeml1gXxl5z+LmQvaDebRz28wXTzx
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4356 set thread context of 32 4356 9269.exe 82 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4356 9269.exe 4356 9269.exe 32 ftp.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4356 9269.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4356 wrote to memory of 32 4356 9269.exe 82 PID 4356 wrote to memory of 32 4356 9269.exe 82 PID 4356 wrote to memory of 32 4356 9269.exe 82 PID 4356 wrote to memory of 32 4356 9269.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\9269.exe"C:\Users\Admin\AppData\Local\Temp\9269.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\ftp.exe"C:\Windows\SysWOW64\ftp.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:32
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
806KB
MD54afac7ce8374da0902f8fad50f0c3bc4
SHA12cdbc6bafa1c4d58bf3b8de68ba67447fe239a27
SHA25667795102332c64ce27e97093b315f95d1756e6337d93d96dc8c895767f09fa73
SHA5126e308665920ae61cb09252c15e652898f265ef708090265d5ca2e8f46d187170b40a9d8d3fce079379fe353cb63a46c894658a03a4fe0cee43fe702eed12164e