Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 06:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
October'23 Statement of Account.exe
Resource
win7-20231020-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
October'23 Statement of Account.exe
Resource
win10v2004-20231023-en
8 signatures
150 seconds
General
-
Target
October'23 Statement of Account.exe
-
Size
608KB
-
MD5
67a443f6dfc350f6def3680b95c674de
-
SHA1
0f3b4aae9491bba6f729a75b1824717921a8bb80
-
SHA256
97863fc07fc27a0f99a2d434e307d7530364bfc137f8fd36a68674f1eae3533f
-
SHA512
fb03f0070b6e411e318988313423a722650d6993c2ccb1542128a9d3edb220e91945d25d9ef035dd51ac9838f34e9aa794b4ca9a6a1b9c7d1e8832bf556d6c89
-
SSDEEP
12288:x2lvgVn4eGFKe3LUfgJLFZpADKuojTFqVsUenPzNuVW:DnFGn3wfqLFZ86p3PzNus
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3032 set thread context of 4772 3032 October'23 Statement of Account.exe 101 PID 4772 set thread context of 3100 4772 RegSvcs.exe 51 PID 4772 set thread context of 2884 4772 RegSvcs.exe 110 PID 2884 set thread context of 3100 2884 fontview.exe 51 -
description ioc Process Key created \Registry\User\S-1-5-21-3125601242-331447593-1512828465-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 fontview.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 3032 October'23 Statement of Account.exe 3032 October'23 Statement of Account.exe 3032 October'23 Statement of Account.exe 3032 October'23 Statement of Account.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 4772 RegSvcs.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3100 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 4772 RegSvcs.exe 3100 Explorer.EXE 3100 Explorer.EXE 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe 2884 fontview.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3032 October'23 Statement of Account.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3100 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2224 3032 October'23 Statement of Account.exe 100 PID 3032 wrote to memory of 2224 3032 October'23 Statement of Account.exe 100 PID 3032 wrote to memory of 2224 3032 October'23 Statement of Account.exe 100 PID 3032 wrote to memory of 4772 3032 October'23 Statement of Account.exe 101 PID 3032 wrote to memory of 4772 3032 October'23 Statement of Account.exe 101 PID 3032 wrote to memory of 4772 3032 October'23 Statement of Account.exe 101 PID 3032 wrote to memory of 4772 3032 October'23 Statement of Account.exe 101 PID 3032 wrote to memory of 4772 3032 October'23 Statement of Account.exe 101 PID 3032 wrote to memory of 4772 3032 October'23 Statement of Account.exe 101 PID 3100 wrote to memory of 2884 3100 Explorer.EXE 110 PID 3100 wrote to memory of 2884 3100 Explorer.EXE 110 PID 3100 wrote to memory of 2884 3100 Explorer.EXE 110 PID 2884 wrote to memory of 4984 2884 fontview.exe 112 PID 2884 wrote to memory of 4984 2884 fontview.exe 112 PID 2884 wrote to memory of 4984 2884 fontview.exe 112
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\October'23 Statement of Account.exe"C:\Users\Admin\AppData\Local\Temp\October'23 Statement of Account.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2224
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4772
-
-
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\SysWOW64\fontview.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4984
-
-