Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2023, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe
Resource
win10v2004-20231023-en
General
-
Target
92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe
-
Size
9.9MB
-
MD5
0a535a52a6ccaf92eef9d7c6cd7359e3
-
SHA1
b9055c8e73235c12eeb1784917738678f00b1f21
-
SHA256
92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3
-
SHA512
98695cdbc9d930b9d158883a0f321327578ed3de10000b2e45e2c3fec712f36d45fc88f6286178c9f4b0a7c696463922f74e66280233bba8494883e80e3371f1
-
SSDEEP
196608:cgJVpbFLVQME2Hx6j1X4rkfxYC3Y87LuapQHTBLf9PDzh7:r5bFiXoi4wfxRY0r6ZH7
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2108 92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe"C:\Users\Admin\AppData\Local\Temp\92cf720e199cc61df2b641ba12c7ad4b891e04e849666021e0424a2bb6e2cfc3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2108