Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 00:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e8ba02d6dbbede5b548b8dd300e63fd.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e8ba02d6dbbede5b548b8dd300e63fd.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
1e8ba02d6dbbede5b548b8dd300e63fd.exe
-
Size
570KB
-
MD5
1e8ba02d6dbbede5b548b8dd300e63fd
-
SHA1
c5fc1c269422d266b202bec97593ff24cb90986c
-
SHA256
e8ad13f1f12027670ed2a01249e45ee65b38accbddd3ec2473c8d919c5bea5ba
-
SHA512
b4db434f23797825d57710ed70206938e56aab32bc76667fdcef350c492ab291ebd5e9a52bad1eedc9da5eda2155ff47e70c991182830648378a849c71975867
-
SSDEEP
12288:6wwIXw0bdyx98oWOU1ZIH5JsXXFJ6upKIgpWy/XZT9KFun3aHv:bW2oWOQZIyFJjUINFHv
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 924 stdrt.exe -
Loads dropped DLL 5 IoCs
pid Process 924 stdrt.exe 924 stdrt.exe 924 stdrt.exe 924 stdrt.exe 924 stdrt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 924 stdrt.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 924 stdrt.exe 3104 OpenWith.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2232 wrote to memory of 924 2232 1e8ba02d6dbbede5b548b8dd300e63fd.exe 16 PID 2232 wrote to memory of 924 2232 1e8ba02d6dbbede5b548b8dd300e63fd.exe 16 PID 2232 wrote to memory of 924 2232 1e8ba02d6dbbede5b548b8dd300e63fd.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e8ba02d6dbbede5b548b8dd300e63fd.exe"C:\Users\Admin\AppData\Local\Temp\1e8ba02d6dbbede5b548b8dd300e63fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\mrt446B.tmp\stdrt.exe"C:\Users\Admin\AppData\Local\Temp\mrt446B.tmp\stdrt.exe" /SF "C:\Users\Admin\AppData\Local\Temp\1e8ba02d6dbbede5b548b8dd300e63fd.exe" /SO942082⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:924
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3104