Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 08:23
Behavioral task
behavioral1
Sample
11be724bb9e0be047956c3d4549845d3.exe
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
11be724bb9e0be047956c3d4549845d3.exe
Resource
win10v2004-20231215-en
5 signatures
150 seconds
General
-
Target
11be724bb9e0be047956c3d4549845d3.exe
-
Size
200KB
-
MD5
11be724bb9e0be047956c3d4549845d3
-
SHA1
bbfa376b1cf8adf64c1646f50a8208ee11c69a7b
-
SHA256
4a6785c13a980b761cdb742975d5e573e072d622c9e4ffdd3af16f2624be2c75
-
SHA512
7fbbd99df73358805003153657b1655123707d7902fa2a06ddbbb983852246bf93b1703813aa54c7a858593196e48b658368aac8fe1a5c22e8185d22ab9d6687
-
SSDEEP
1536:5fuDBNMuKN2EIrS9QRu7YwlS0/4kwHuTthFzBg0UE9xmAsm4Yr68QIy8KdB2i6x0:RSMUPS9+6jU0/2yKTSmFYr6ZHX56x0
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3864-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3864-8-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3864 set thread context of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 set thread context of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 set thread context of 0 3864 11be724bb9e0be047956c3d4549845d3.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2276 11be724bb9e0be047956c3d4549845d3.exe 2276 11be724bb9e0be047956c3d4549845d3.exe 2276 11be724bb9e0be047956c3d4549845d3.exe 2276 11be724bb9e0be047956c3d4549845d3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3864 11be724bb9e0be047956c3d4549845d3.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3864 wrote to memory of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 wrote to memory of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 wrote to memory of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 wrote to memory of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 wrote to memory of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 wrote to memory of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 wrote to memory of 2276 3864 11be724bb9e0be047956c3d4549845d3.exe 88 PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 3864 wrote to memory of 0 3864 11be724bb9e0be047956c3d4549845d3.exe PID 2276 wrote to memory of 3556 2276 11be724bb9e0be047956c3d4549845d3.exe 50 PID 2276 wrote to memory of 3556 2276 11be724bb9e0be047956c3d4549845d3.exe 50 PID 2276 wrote to memory of 3556 2276 11be724bb9e0be047956c3d4549845d3.exe 50 PID 2276 wrote to memory of 3556 2276 11be724bb9e0be047956c3d4549845d3.exe 50
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\11be724bb9e0be047956c3d4549845d3.exe"C:\Users\Admin\AppData\Local\Temp\11be724bb9e0be047956c3d4549845d3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\11be724bb9e0be047956c3d4549845d3.exe"C:\Users\Admin\AppData\Local\Temp\11be724bb9e0be047956c3d4549845d3.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2276
-
-