Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 19:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39070e7fc3ce65f4fe757596af4c1778.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
39070e7fc3ce65f4fe757596af4c1778.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
39070e7fc3ce65f4fe757596af4c1778.exe
-
Size
55KB
-
MD5
39070e7fc3ce65f4fe757596af4c1778
-
SHA1
3014e211f5917f7436587eb07fd5dd015b713633
-
SHA256
cb6f729631590883ee1950b6b5296ca6261b64ef2b35e68481b229b3a7eea78d
-
SHA512
1fa05d5885e09282d442cc3c17d34f8070744deca4d9337bc2e391b0833f66ea77d38f146229d1d1745b2ae480d50b42642ad70c2dd0e496b126ab7425176915
-
SSDEEP
768:0nzj3Ypmt9rb/s/JLFOU9juSxyOF4sMXHerGCEEzGzWAbRl15Aoj9JM:czjIpErzmJgU9jziBCnKlL76
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5032 set thread context of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4564 39070e7fc3ce65f4fe757596af4c1778.exe 4564 39070e7fc3ce65f4fe757596af4c1778.exe 4564 39070e7fc3ce65f4fe757596af4c1778.exe 4564 39070e7fc3ce65f4fe757596af4c1778.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5032 39070e7fc3ce65f4fe757596af4c1778.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 PID 5032 wrote to memory of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 PID 5032 wrote to memory of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 PID 5032 wrote to memory of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 PID 5032 wrote to memory of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 PID 5032 wrote to memory of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 PID 5032 wrote to memory of 4564 5032 39070e7fc3ce65f4fe757596af4c1778.exe 89 PID 4564 wrote to memory of 3452 4564 39070e7fc3ce65f4fe757596af4c1778.exe 13 PID 4564 wrote to memory of 3452 4564 39070e7fc3ce65f4fe757596af4c1778.exe 13 PID 4564 wrote to memory of 3452 4564 39070e7fc3ce65f4fe757596af4c1778.exe 13 PID 4564 wrote to memory of 3452 4564 39070e7fc3ce65f4fe757596af4c1778.exe 13
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\39070e7fc3ce65f4fe757596af4c1778.exe"C:\Users\Admin\AppData\Local\Temp\39070e7fc3ce65f4fe757596af4c1778.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\39070e7fc3ce65f4fe757596af4c1778.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4564
-
-