Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2023, 04:04
Static task
static1
Behavioral task
behavioral1
Sample
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
Resource
win10v2004-20230915-en
General
-
Target
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
-
Size
2.2MB
-
MD5
fbf88f5b73ed2e893834ad27f3e2c133
-
SHA1
048ecd071ee7c51abfad511519f26875ab593e56
-
SHA256
0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3
-
SHA512
75dce88b2d9f97b610b3821934e681a297e1dd4af2044ea50a8a26c55d23ed8de228df08acb2aa7bdb298a5b24cf3d0b08af7d73a105db69177c40660f716d4d
-
SSDEEP
24576:HsxHA8D1HT4jmQdbXf0qMmclpKmXG4yC8uhuXG+u8j0b2pS82EEN5jqu2+tEBADf:kfJ+dL0ZBlpSLuo1pIneu2UDTtPN
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/568-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-4-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-14-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-16-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-18-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-20-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-22-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-24-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-26-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-34-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-36-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-38-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-40-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/568-48-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 568 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe 568 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 568 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe 568 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe 568 0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe"C:\Users\Admin\AppData\Local\Temp\0ff08817f727f0370eb1b54b8ddf40e0688ab22ed98c14932daf2ca284f954d3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:568