Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 21:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pozemenutroll.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
pozemenutroll.exe
Resource
win10v2004-20230915-en
3 signatures
150 seconds
General
-
Target
pozemenutroll.exe
-
Size
14.8MB
-
MD5
86d5019d46253f5efacaf182e41fbd26
-
SHA1
f62eef1bbc213651c8cd6e93faf07dcbbe80198a
-
SHA256
e2b945c729a639d8d2e5924e98a65a6792e2bac3b17813c9f9e845e34f84b4b9
-
SHA512
3b2cfbc58d9b754d02b89df1784c7e7403d28d9bccb97776c86149f9b4c616792d5a674a0c1e79b23986b417b44ead092af75920beede4073fe3f0bd3c0b655f
-
SSDEEP
196608:4BLhL4YrNZv+dV+VcjfFvQU0gGunkLAMECCLi7mi3Pc/dV2K35cBwkagMgn+ryP5:4BNQ+QhcdXLg7qjE2K35AwkagMdy
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1508 pozemenutroll.exe 1508 pozemenutroll.exe 1508 pozemenutroll.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1508 pozemenutroll.exe 1508 pozemenutroll.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2456 1508 pozemenutroll.exe 84 PID 1508 wrote to memory of 2456 1508 pozemenutroll.exe 84 PID 2456 wrote to memory of 1484 2456 cmd.exe 85 PID 2456 wrote to memory of 1484 2456 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\pozemenutroll.exe"C:\Users\Admin\AppData\Local\Temp\pozemenutroll.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c MODE CON COLS=55 LINES=122⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\system32\mode.comMODE CON COLS=55 LINES=123⤵PID:1484
-
-