Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    173s
  • max time network
    286s
  • platform
    windows10-1703_x64
  • resource
    win10-20231023-en
  • resource tags

    arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/10/2023, 22:18

General

  • Target

    1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe

  • Size

    323KB

  • MD5

    d089ef164450b8152526b53155ffb55c

  • SHA1

    899c09a42afcd9b66f1201487e29f30749176ed2

  • SHA256

    1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab

  • SHA512

    469d2ca6afd13f22c4b460368437026aba348e6392af1b5d8df2fef6dbfa638a2b6e39374fa3662c3adc8a7b59d4dc5e7a3eb042acbed1a86def41ae7d9996f9

  • SSDEEP

    6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
    "C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4172
    • C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
      C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
      2⤵
        PID:4636
      • C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
        C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
        2⤵
          PID:4640

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4172-0-0x0000000000080000-0x00000000000D6000-memory.dmp

        Filesize

        344KB

      • memory/4172-1-0x00000000737E0000-0x0000000073ECE000-memory.dmp

        Filesize

        6.9MB

      • memory/4172-2-0x0000000004A40000-0x0000000004B0C000-memory.dmp

        Filesize

        816KB

      • memory/4172-3-0x00000000073B0000-0x00000000078AE000-memory.dmp

        Filesize

        5.0MB

      • memory/4172-4-0x0000000006F50000-0x0000000006FE2000-memory.dmp

        Filesize

        584KB

      • memory/4172-5-0x0000000002360000-0x0000000002366000-memory.dmp

        Filesize

        24KB

      • memory/4172-6-0x0000000004B20000-0x0000000004B30000-memory.dmp

        Filesize

        64KB

      • memory/4172-7-0x00000000071F0000-0x0000000007266000-memory.dmp

        Filesize

        472KB

      • memory/4172-8-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

        Filesize

        120KB

      • memory/4172-11-0x00000000737E0000-0x0000000073ECE000-memory.dmp

        Filesize

        6.9MB

      • memory/4640-9-0x0000000000400000-0x0000000000406000-memory.dmp

        Filesize

        24KB