Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
3b34b8222e2f367795e5c64459bb6414.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b34b8222e2f367795e5c64459bb6414.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
3b34b8222e2f367795e5c64459bb6414.exe
-
Size
602KB
-
MD5
3b34b8222e2f367795e5c64459bb6414
-
SHA1
ebba945d69c94aac61771eddbcd422fc64025e3b
-
SHA256
1268780bd4d4e27f57c90a494a97660c31ef85e12054632e45bea9b4a915ff12
-
SHA512
6b3c11360c7edbca280ab7b7848b975631893e2d963dec2627c7fe6571e169c3c809f855676cb454426f64c5205eed1ce524f1090c924cac1b28f434771dfb32
-
SSDEEP
12288:cU0/GFk2qgwSp31LXgRDK6niecVEIlsMbhOB8Rc7KRFMD:Al2qs4n1wHKQhPi
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1544 3b34b8222e2f367795e5c64459bb6414.exe 464 3b34b8222e2f367795e5c64459bb6414.exe 4500 3b34b8222e2f367795e5c64459bb6414.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings 3b34b8222e2f367795e5c64459bb6414.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1544 wrote to memory of 464 1544 3b34b8222e2f367795e5c64459bb6414.exe 90 PID 1544 wrote to memory of 464 1544 3b34b8222e2f367795e5c64459bb6414.exe 90 PID 1544 wrote to memory of 464 1544 3b34b8222e2f367795e5c64459bb6414.exe 90 PID 1544 wrote to memory of 4500 1544 3b34b8222e2f367795e5c64459bb6414.exe 89 PID 1544 wrote to memory of 4500 1544 3b34b8222e2f367795e5c64459bb6414.exe 89 PID 1544 wrote to memory of 4500 1544 3b34b8222e2f367795e5c64459bb6414.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe"C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exewatch2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4500
-
-
C:\Users\Admin\AppData\Local\Temp\3b34b8222e2f367795e5c64459bb6414.exestart2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
PID:464
-