Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2023, 17:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe
Resource
win7-20231020-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe
-
Size
152KB
-
MD5
adac12ba18cfcc30eabbc9d7f1ad9e97
-
SHA1
f70664b32f8a02c3045513dc32dd746b0153fa4e
-
SHA256
3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70
-
SHA512
e3d8846ba9e7e0e1adb208fc298cfa1690fc88c91b1bb9f6a9cf935d3912df1acd66180fcabce2f5b64bdbc204ebb626c84f4f502d683ae7bdb0b5bc4470ee23
-
SSDEEP
192:/TePban9V4qAitaJnUJX3FyFinUw6w57DpMPan9V:/TesDOUJX1lUw66pMg
Score
1/10
Malware Config
Signatures
-
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "txt" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "bat" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.png cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exe" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.png\ = "png" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.jpg\ = "jpg" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.txt cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.jpg cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "reg" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ico cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com\ = "com" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "vbs" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "cmd" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.html cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.html\ = "html" cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ico\ = "ico" cmd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.com cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2144 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 90 PID 2168 wrote to memory of 2144 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 90 PID 2168 wrote to memory of 2144 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 90 PID 2168 wrote to memory of 3572 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 91 PID 2168 wrote to memory of 3572 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 91 PID 2168 wrote to memory of 3572 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 91 PID 2168 wrote to memory of 2372 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 111 PID 2168 wrote to memory of 2372 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 111 PID 2168 wrote to memory of 2372 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 111 PID 2168 wrote to memory of 1948 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 110 PID 2168 wrote to memory of 1948 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 110 PID 2168 wrote to memory of 1948 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 110 PID 2168 wrote to memory of 1420 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 109 PID 2168 wrote to memory of 1420 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 109 PID 2168 wrote to memory of 1420 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 109 PID 2168 wrote to memory of 4712 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 108 PID 2168 wrote to memory of 4712 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 108 PID 2168 wrote to memory of 4712 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 108 PID 2168 wrote to memory of 1696 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 107 PID 2168 wrote to memory of 1696 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 107 PID 2168 wrote to memory of 1696 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 107 PID 2168 wrote to memory of 5028 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 106 PID 2168 wrote to memory of 5028 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 106 PID 2168 wrote to memory of 5028 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 106 PID 2168 wrote to memory of 656 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 92 PID 2168 wrote to memory of 656 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 92 PID 2168 wrote to memory of 656 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 92 PID 2168 wrote to memory of 436 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 94 PID 2168 wrote to memory of 436 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 94 PID 2168 wrote to memory of 436 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 94 PID 2168 wrote to memory of 4268 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 93 PID 2168 wrote to memory of 4268 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 93 PID 2168 wrote to memory of 4268 2168 3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe"C:\Users\Admin\AppData\Local\Temp\3e6bce0dc9c944b2164483f9f77863177eac5246f3486d5ebd35232a444fca70.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\cmd.execmd /c assoc .exe=exe2⤵
- Modifies registry class
PID:2144
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .txt=txt2⤵
- Modifies registry class
PID:3572
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .html=html2⤵
- Modifies registry class
PID:656
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .reg=reg2⤵
- Modifies registry class
PID:4268
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .vbs=vbs2⤵
- Modifies registry class
PID:436
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .ico=ico2⤵
- Modifies registry class
PID:5028
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .jpg=jpg2⤵
- Modifies registry class
PID:1696
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .png=png2⤵
- Modifies registry class
PID:4712
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .com=com2⤵
- Modifies registry class
PID:1420
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .cmd=cmd2⤵
- Modifies registry class
PID:1948
-
-
C:\Windows\SysWOW64\cmd.execmd /c assoc .bat=bat2⤵
- Modifies registry class
PID:2372
-