Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

8e2f03eac9...87.exe

windows7-x64

7

8e2f03eac9...87.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2023, 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8e2f03eac99f30c3beaaaf500abe826b69faf74688c65c0fa459e0250cdeb387.exe

  • Size

    816KB

  • MD5

    d0a3752879522a31412b739e917bdef9

  • SHA1

    470471ea728e391631c61a4c5b49157e5da8d858

  • SHA256

    8e2f03eac99f30c3beaaaf500abe826b69faf74688c65c0fa459e0250cdeb387

  • SHA512

    cfffeb92a7737056e166ef022484c87fe24b4e63d502b08b3cf8fa109a9da7ddc29a33ef14e67579d4bb94c300ad644bc1047340fea4681f6359ede3907836f2

  • SSDEEP

    24576:HY4G2qLMJalsnqShyoo77lUabuSvbDQOOdIxJsG90:43XZynV4oDabuWbDQOcIxJJ90

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e2f03eac99f30c3beaaaf500abe826b69faf74688c65c0fa459e0250cdeb387.exe
    "C:\Users\Admin\AppData\Local\Temp\8e2f03eac99f30c3beaaaf500abe826b69faf74688c65c0fa459e0250cdeb387.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Users\Admin\AppData\Local\Temp\1D0A0C0A120C156A155B15F0A0D160C0B160D.exe
      C:\Users\Admin\AppData\Local\Temp\1D0A0C0A120C156A155B15F0A0D160C0B160D.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2252

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1D0A0C0A120C156A155B15F0A0D160C0B160D.exe
    Filesize

    816KB

    MD5

    8e8bd0c6d82b22fd9ecf6fa2052f83cb

    SHA1

    4db750f6e218ce0e67e880c676f4d054773752ba

    SHA256

    541bbb463d5db48551426a18f3e2b62ad8a0426f9ae481e73c0a418f3aaf0298

    SHA512

    be4bc99d15ba88bb3cc72cb37937aec338965a196224afd2e55a6b0837d3cafffa2307758a6ccbcb726715f7c63a7b293139c23518e6c739dff9058af84a61d7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1D0A0C0A120C156A155B15F0A0D160C0B160D.exe
    Filesize

    816KB

    MD5

    8e8bd0c6d82b22fd9ecf6fa2052f83cb

    SHA1

    4db750f6e218ce0e67e880c676f4d054773752ba

    SHA256

    541bbb463d5db48551426a18f3e2b62ad8a0426f9ae481e73c0a418f3aaf0298

    SHA512

    be4bc99d15ba88bb3cc72cb37937aec338965a196224afd2e55a6b0837d3cafffa2307758a6ccbcb726715f7c63a7b293139c23518e6c739dff9058af84a61d7

    Download Submit

  • memory/1864-0-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1864-2-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1864-8-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2252-9-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2252-11-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2252-12-0x0000000000400000-0x00000000005AD000-memory.dmp

    Filesize

    1.7MB

    Download