Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 21:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa6d3ba29b91752ded3e40dad3e5bbe2.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa6d3ba29b91752ded3e40dad3e5bbe2.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
fa6d3ba29b91752ded3e40dad3e5bbe2.exe
-
Size
388KB
-
MD5
fa6d3ba29b91752ded3e40dad3e5bbe2
-
SHA1
67d4f3fa27eb87374acb5a0a9d6d2ac40d8c8ecb
-
SHA256
bd2a2be3352de8948702e9356e18d51bd4e08d911a7e4ff6ef04a2ad5c6c980e
-
SHA512
af2010e034f20bdbbd2093c740ddbdc1a8c0ee9bbcf670ffc52631f1f958f09366cf309be8d1c0066c2526ec6b1c3567c5b1e4e36c2c6053308a7c98f516cb15
-
SSDEEP
12288:uJYBKF6Kl/uAcihICiinfIK8XViTBjW5KU95:ueB7C+ihIyfINXYTdWAU95
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pmsl = "\"c:\\users\\admin\\appdata\\local\\temp\\fa6d3ba29b91752ded3e40dad3e5bbe2.exe\"" fa6d3ba29b91752ded3e40dad3e5bbe2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4820 fa6d3ba29b91752ded3e40dad3e5bbe2.exe 4820 fa6d3ba29b91752ded3e40dad3e5bbe2.exe