Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
13f13995d78c6c491e1557a0919481a5.hta
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
13f13995d78c6c491e1557a0919481a5.hta
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
13f13995d78c6c491e1557a0919481a5.hta
-
Size
11KB
-
MD5
13f13995d78c6c491e1557a0919481a5
-
SHA1
6b9f003341e53609934b09910fa8fca204187d35
-
SHA256
573e06b3f0deae39074880a5f7fb369d84468ec31610fddf32188b2fb722385f
-
SHA512
e821648925795be1bd656fb0fcf6686efb410189cda302bd66d345527c06f1965dc85dd6cba50ecfe293485accf3f63b333259e7c93579b1e4dfed9ca4df22b5
-
SSDEEP
192:Z4G4G4v4WCKuJD4B4B4B4B4S4B4B4a4S424r4y4pj2424N4Iv494z4h4h4h4C4Gk:Z9bKoIIIIXIIFr/evcqfiVv4EIIIbNIV
Score
1/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2524 wrote to memory of 3296 2524 mshta.exe 48 PID 2524 wrote to memory of 3296 2524 mshta.exe 48 PID 2524 wrote to memory of 3296 2524 mshta.exe 48
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\13f13995d78c6c491e1557a0919481a5.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qPaperFolio.dll,D2D1CreateFactory2⤵PID:3296
-