Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
286s -
platform
windows10-1703_x64 -
resource
win10-20231023-en -
resource tags
arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system -
submitted
29/10/2023, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
Resource
win10-20231023-en
General
-
Target
1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe
-
Size
323KB
-
MD5
d089ef164450b8152526b53155ffb55c
-
SHA1
899c09a42afcd9b66f1201487e29f30749176ed2
-
SHA256
1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab
-
SHA512
469d2ca6afd13f22c4b460368437026aba348e6392af1b5d8df2fef6dbfa638a2b6e39374fa3662c3adc8a7b59d4dc5e7a3eb042acbed1a86def41ae7d9996f9
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4172 set thread context of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4172 wrote to memory of 4636 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 71 PID 4172 wrote to memory of 4636 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 71 PID 4172 wrote to memory of 4636 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 71 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72 PID 4172 wrote to memory of 4640 4172 1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe"C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exeC:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe2⤵PID:4636
-
-
C:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exeC:\Users\Admin\AppData\Local\Temp\1d63d8935ee242e9c8c5b80306038e71be83d4c8c09b198289fa30d3fca644ab.exe2⤵PID:4640
-