Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 06:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b2145400fe9b11dd1048e4ba2f3bc8f.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b2145400fe9b11dd1048e4ba2f3bc8f.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
5b2145400fe9b11dd1048e4ba2f3bc8f.exe
-
Size
208KB
-
MD5
5b2145400fe9b11dd1048e4ba2f3bc8f
-
SHA1
f98a1da272c368fb1e0f467ba624064600c23253
-
SHA256
e0750dc16b5f93ba2f7f05dd6bb51a63ba8500c971cfd60b9d778db1d5a94ac5
-
SHA512
02ab94ce1ddb34aa3ed4220302171d1b57e45046af19058644fd4e26e9e70d3ef5fc10eeb10fc110f6bac252447cac8b228f16d81828a0c8088fc488bcedb3c0
-
SSDEEP
3072:w/Y+7IXdeOnVLyCGuVbh9sfp0Rip/j1B/Tuw8v/:67CtJh9sfp0gj1M/
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2956 set thread context of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2956 wrote to memory of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 PID 2956 wrote to memory of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 PID 2956 wrote to memory of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 PID 2956 wrote to memory of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 PID 2956 wrote to memory of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 PID 2956 wrote to memory of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 PID 2956 wrote to memory of 4492 2956 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 26 PID 4492 wrote to memory of 3316 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 45 PID 4492 wrote to memory of 3316 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 45 PID 4492 wrote to memory of 3316 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 45 PID 4492 wrote to memory of 3316 4492 5b2145400fe9b11dd1048e4ba2f3bc8f.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"C:\Users\Admin\AppData\Local\Temp\5b2145400fe9b11dd1048e4ba2f3bc8f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3316