Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2023, 21:13
Static task
static1
Behavioral task
behavioral1
Sample
96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe
Resource
win10v2004-20230703-en
General
-
Target
96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe
-
Size
2.3MB
-
MD5
e938935db1909a33473aad99b2c3b685
-
SHA1
a98ff67336da2f38676d18243c6a9be2758518b7
-
SHA256
96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129
-
SHA512
787b079585859efbf3452e50f31b79cb87ea7869b7862aad672cde9f0ee1f983d3bc284b28c56819653eeee32c587c88eeea59b446f835ce9c69494f54ad36d6
-
SSDEEP
24576:Es8jONh5DQwsJAyLVn3eody1VEYYUba3PwhQtLOEDbF4:NdEJt3eQwWYYUu3PaMxF4
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2944-134-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-133-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-135-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-136-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-138-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-140-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-142-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-144-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-146-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-148-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-150-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-152-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-154-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-156-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-158-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-160-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-162-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-164-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-166-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-168-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-170-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-172-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-174-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-176-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/2944-177-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2944 96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe 2944 96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2944 96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe 2944 96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe 2944 96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe"C:\Users\Admin\AppData\Local\Temp\96d8cbc79f3be5d70af8cb20c8b2349bbde28399cda4ae372f0157be3bb18129.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2944