Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 05:06
Static task
static1
Behavioral task
behavioral1
Sample
5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe
Resource
win10v2004-20230915-en
General
-
Target
5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe
-
Size
2.8MB
-
MD5
35e288c998c6bd998a015bc409d8e5e2
-
SHA1
62e2b709f96d0ac168a9909ee48b81bc803b93c7
-
SHA256
5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d
-
SHA512
932446a648339e33fb1aff05b0ef31f2ca2e8f09da5b22025c401aabca758d4130368c7d2a008963d57d48d02bec2f030ddbd216cf743565f72a86763d4e9aa3
-
SSDEEP
49152:ra7vo3ZM0DqFJckphaaB6PtjPxWK1hOhhZmy4AQoTbO0tIsJ:ra7ApT+FJu7HfLEbQoTbOOJ
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1304-13086-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13089-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13088-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13090-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13091-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13092-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13094-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13096-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13098-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13101-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13103-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13105-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13107-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13109-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13111-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13113-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13115-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13119-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13117-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13121-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13123-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13125-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13127-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13129-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13131-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13133-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/1304-13135-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
pid Process 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe 1304 5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe"C:\Users\Admin\AppData\Local\Temp\5a4585eba262fa835563e5dafb33e22ae2fa7a79f26760defee00f3f67f4776d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1304