Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe
Resource
win10v2004-20230703-en
General
-
Target
30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe
-
Size
4.1MB
-
MD5
87378f251b50221baf2ebc5788e34cc6
-
SHA1
3b0e32351808b874bb8c853bf8ed77fa0d305ba8
-
SHA256
30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9
-
SHA512
3392f6af66b9bb6d2ce4ca5868eb0222edd144e2528ca2c779d4468f42972e9ca69012070501ddc2374317422b47faa50a49548d392a88d87d3d765c60798e82
-
SSDEEP
98304:QGFhU/E/sxrXzICSs5V6YZSYvPSTq8AAZhj:QGKE/ZHg6wS68j7j
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4952-13211-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13213-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13212-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13215-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13217-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13219-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13221-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13223-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13225-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13229-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13231-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13233-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13235-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13237-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13239-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13241-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13243-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13245-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13247-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13249-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13251-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13253-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13255-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/4952-13257-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\WOW6432Node\Interface\{8224C668-8596-82A8-83DC-806E31AE4817} 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe Set value (str) \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\WOW6432Node\Interface\{8224C668-8596-82A8-83DC-806E31AE4817}\ = "rlDhuE6id+qDH+8JoA9h/PD8O6A5UbBJWt1SFOxCgTC82zbHq0PTtsdJ2bhLomfqeB/qCZsPn/oJ9TOgNlGgSU/dTRTnQr8uvNs2x6tD07bgyhy55GiyyzsBW0Rl8PJ/" 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe 4952 30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe"C:\Users\Admin\AppData\Local\Temp\30818a5d73f14b8e203910666a0be769ae8e07d2e106f4ec4882b248fb240ac9.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4952