Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
35s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 02:56
General
-
Target
014653d6b17f29083cbb62debb2993fc.exe
-
Size
8.6MB
-
MD5
014653d6b17f29083cbb62debb2993fc
-
SHA1
710416458c5c0e75aa3d836d64d1f4da5f20b2c2
-
SHA256
c8a40e8a075c7702f16de499dadbe7a8f437579eef39cf980835d111c8cdf173
-
SHA512
3ecedcfa701541c3fd09f272863a11b39f7217fac86fd5d7b58340bba6fed31fac6bf763173a20cc1dff851d4f448dbadc1e04b26d84a70d833b31dd4468e48e
-
SSDEEP
196608:pyq4a9r9hPj5hKAeLykkEU7wiMPnH/ELax32OGgVVPqLp29Bn:pyqF15haLyjEU7wzPld2ePqc
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 7 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\014653d6b17f29083cbb62debb2993fc.exe"C:\Users\Admin\AppData\Local\Temp\014653d6b17f29083cbb62debb2993fc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\zitjgkeytjdtnhjdyedwxecnfaupvcdkqrsuopkllfegxnhjak.uzoqrtavdtC:\Users\Admin\AppData\Local\Temp\zitjgkeytjdtnhjdyedwxecnfaupvcdkqrsuopkllfegxnhjak.uzoqrtavdt C:\Users\Admin\AppData\Local\Temp\014653d6b17f29083cbb62debb2993fc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.9MB
-
Filesize
17.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.9MB
-
Filesize
17.9MB
-
Filesize
17.9MB
-
Filesize
17.9MB