Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

416318c1f0...2f.exe

windows7-x64

7

416318c1f0...2f.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    154s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 08:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    416318c1f000eb12fcacdcd52abf28acd1ef059d1bd09563ef3a44f13e29a62f.exe

  • Size

    812KB

  • MD5

    89da65c87363a3664de13b3c3b4b5830

  • SHA1

    165fe0c0d24915675d1636af60cffa37dfed1ab8

  • SHA256

    416318c1f000eb12fcacdcd52abf28acd1ef059d1bd09563ef3a44f13e29a62f

  • SHA512

    93d04f8e35507806b240b460b0f190d6bbd0b7570e2bc0796c77cf1834fbeaf10fccfcc94f23d3646b9a42822e0d7546a4096d827e0b406cc30ea7b34807ea0c

  • SSDEEP

    12288:1qmytVdB0rPEDb3kCoI641jxy7GHEX2rnAv8MktrOKxp22CMOZ/1Sq:1qxtVfNDb31oT41+aneOrO4p2zMOZ/V

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\416318c1f000eb12fcacdcd52abf28acd1ef059d1bd09563ef3a44f13e29a62f.exe
    "C:\Users\Admin\AppData\Local\Temp\416318c1f000eb12fcacdcd52abf28acd1ef059d1bd09563ef3a44f13e29a62f.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Users\Admin\AppData\Local\Temp\1C0D0D0D120D156F155A15F0E0B160B0F160A.exe
      C:\Users\Admin\AppData\Local\Temp\1C0D0D0D120D156F155A15F0E0B160B0F160A.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1C0D0D0D120D156F155A15F0E0B160B0F160A.exe
    Filesize

    812KB

    MD5

    d9e52539517b2f9a57ada721772e9bfb

    SHA1

    82b9b0720f7a4013e44dd26e7bbebfa01ee5cad6

    SHA256

    6d4b1865382b98ca1f127f462e59feee059f5b19692cd5714e6efeb63ad6b470

    SHA512

    10f428e327280a3347a84b0d1c77c76d73d542b840c240de3162e6e65fc85db72cba92b3ef9c66b3c7d5b78e4f62814803cf0bc68246abe10f0be209438bb2ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1C0D0D0D120D156F155A15F0E0B160B0F160A.exe
    Filesize

    812KB

    MD5

    d9e52539517b2f9a57ada721772e9bfb

    SHA1

    82b9b0720f7a4013e44dd26e7bbebfa01ee5cad6

    SHA256

    6d4b1865382b98ca1f127f462e59feee059f5b19692cd5714e6efeb63ad6b470

    SHA512

    10f428e327280a3347a84b0d1c77c76d73d542b840c240de3162e6e65fc85db72cba92b3ef9c66b3c7d5b78e4f62814803cf0bc68246abe10f0be209438bb2ee

    Download Submit

  • memory/4268-0-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4268-2-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4268-8-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4996-9-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4996-10-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/4996-12-0x0000000000400000-0x00000000005AB000-memory.dmp

    Filesize

    1.7MB

    Download