Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 11:04
Static task
static1
Behavioral task
behavioral1
Sample
aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe
Resource
win10v2004-20230915-en
General
-
Target
aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe
-
Size
2.4MB
-
MD5
4478510a7f7e75f1818e6be7cd08f8dc
-
SHA1
c3f8d3579fd8738c53c907252072a0ea710e922e
-
SHA256
aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea
-
SHA512
41aaf0e1181996ab151085b0a749e40e66a588cc464b88967c1f7fb7747d893c0726a6b17c3ea9ccdc29359236ba5e3eb57218cf6d617e435b664d90e9324b4b
-
SSDEEP
49152:mLTsFrXMrS6DkqSdpkisUA1W0R6CDq2ic+umv4qP5Sk:mLTsFrXmS6DkqSfk7PLfyv4qP5Sk
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs
pid Process 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe 4188 aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe"C:\Users\Admin\AppData\Local\Temp\aec88614e7019ca5b4cd436f812857791bce47725e17570cf8b778cb8463ebea.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4188