Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 22:49
Behavioral task
behavioral1
Sample
414f2f01869a018ccab15567cf90c342.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
414f2f01869a018ccab15567cf90c342.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
414f2f01869a018ccab15567cf90c342.exe
-
Size
5.8MB
-
MD5
414f2f01869a018ccab15567cf90c342
-
SHA1
5cec551f09ea09d03b727be7d7d12e7e201565c3
-
SHA256
655e1dfd1971496d443f0f27d125332a0c6c9c92a24b1d78f9b41d08c469c29e
-
SHA512
f2ba4f58fe5e869fc6c12efb8f6c8b122a90fad567e784966f8e736b3a5eaa5e33130ae0b96564f1b09e481c46f0772ee2cc1b0ff97620aa5d2fe33829da7246
-
SSDEEP
98304:vAiVoYp0VGQZaXhP5a9UEI+eG9jAkbkR79D+cVItGQZaXhP5a9UEI+eG:vAiiXnGhRaaCkN9qHGhRa
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1128 414f2f01869a018ccab15567cf90c342.exe -
Executes dropped EXE 1 IoCs
pid Process 1128 414f2f01869a018ccab15567cf90c342.exe -
resource yara_rule behavioral2/memory/1172-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral2/memory/1128-14-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1172 414f2f01869a018ccab15567cf90c342.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1172 414f2f01869a018ccab15567cf90c342.exe 1128 414f2f01869a018ccab15567cf90c342.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1128 1172 414f2f01869a018ccab15567cf90c342.exe 20 PID 1172 wrote to memory of 1128 1172 414f2f01869a018ccab15567cf90c342.exe 20 PID 1172 wrote to memory of 1128 1172 414f2f01869a018ccab15567cf90c342.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\414f2f01869a018ccab15567cf90c342.exe"C:\Users\Admin\AppData\Local\Temp\414f2f01869a018ccab15567cf90c342.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\414f2f01869a018ccab15567cf90c342.exeC:\Users\Admin\AppData\Local\Temp\414f2f01869a018ccab15567cf90c342.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1128
-