Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
055a4c82658aa233c9b223a0e44abfb2.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
055a4c82658aa233c9b223a0e44abfb2.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
055a4c82658aa233c9b223a0e44abfb2.exe
-
Size
584KB
-
MD5
055a4c82658aa233c9b223a0e44abfb2
-
SHA1
e662c0491f0c511739a14d6038e0e9b4ab64a4e7
-
SHA256
4e4b4bd204eeb1706cdafad2ba56096cf2bdc2acc6a40ba84c3f9e9872499383
-
SHA512
eaec1dbcd8924c6b8be0cdc63e5fe07ee4193020d26b7f63af69d20bfd8d82ca4f9d1903354a616de2f719329682f68c0177aba2b37c825cd0d3a165b89d4109
-
SSDEEP
12288:IfioJ27f8GH4tNODBnXQRDpxS1c2obY7h1YcE9Zhi7B0prye5:6zGHGODIxAoclehi7uprye5
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3748 msn.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3748 set thread context of 1280 3748 msn.exe 23 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\System\msn.exe 055a4c82658aa233c9b223a0e44abfb2.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4076 055a4c82658aa233c9b223a0e44abfb2.exe 4076 055a4c82658aa233c9b223a0e44abfb2.exe 3748 msn.exe 3748 msn.exe 1280 svchost.exe 1280 svchost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1280 svchost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3748 wrote to memory of 1280 3748 msn.exe 23 PID 3748 wrote to memory of 1280 3748 msn.exe 23 PID 3748 wrote to memory of 1280 3748 msn.exe 23 PID 4076 wrote to memory of 2316 4076 055a4c82658aa233c9b223a0e44abfb2.exe 24 PID 4076 wrote to memory of 2316 4076 055a4c82658aa233c9b223a0e44abfb2.exe 24 PID 4076 wrote to memory of 2316 4076 055a4c82658aa233c9b223a0e44abfb2.exe 24 PID 3748 wrote to memory of 1280 3748 msn.exe 23 PID 3748 wrote to memory of 1280 3748 msn.exe 23
Processes
-
C:\Users\Admin\AppData\Local\Temp\055a4c82658aa233c9b223a0e44abfb2.exe"C:\Users\Admin\AppData\Local\Temp\055a4c82658aa233c9b223a0e44abfb2.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ESSODT.bat2⤵PID:2316
-
-
C:\Program Files (x86)\Common Files\System\msn.exe"C:\Program Files (x86)\Common Files\System\msn.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe" 991772⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1280
-