Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 23:12
Behavioral task
behavioral1
Sample
0699bcd46158669818cc9f8fef3fe753.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
0699bcd46158669818cc9f8fef3fe753.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
0699bcd46158669818cc9f8fef3fe753.exe
-
Size
134KB
-
MD5
0699bcd46158669818cc9f8fef3fe753
-
SHA1
faa3015fd6893289fda8fc59b5da433264a85844
-
SHA256
31d5ec271c744397f48bfc6af418b450610ac39c718690f350b564d2e5a4994d
-
SHA512
89268d68b9378f55d811394a30805c156b4e259c8d4794507fc9ac195b817bc0b4c5361bc0ae79daf292eed024aa8006ee919a78d3a13ef0e6e28b3ff27f69d5
-
SSDEEP
3072:s1u0Ge/rORlQLMvtWT4bLpVBBY1J4Bhk8OGVnIwQpzjout:sQBe/rOROM1WT4bL7Hz88OGVnI9HoS
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3004-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3004-1-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4420-20-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 3004 0699bcd46158669818cc9f8fef3fe753.exe 4420 voussooquukur.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3004 wrote to memory of 4420 3004 0699bcd46158669818cc9f8fef3fe753.exe 94 PID 3004 wrote to memory of 4420 3004 0699bcd46158669818cc9f8fef3fe753.exe 94 PID 3004 wrote to memory of 4420 3004 0699bcd46158669818cc9f8fef3fe753.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\0699bcd46158669818cc9f8fef3fe753.exe"C:\Users\Admin\AppData\Local\Temp\0699bcd46158669818cc9f8fef3fe753.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\voussooquukur.exeC:\Windows\system32\voussooquukur.exe2⤵
- Suspicious behavior: RenamesItself
PID:4420
-