Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 03:52
Behavioral task
behavioral1
Sample
0d819bbc31ae6f0fbd8fc1f359e8a566.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d819bbc31ae6f0fbd8fc1f359e8a566.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
0d819bbc31ae6f0fbd8fc1f359e8a566.exe
-
Size
56KB
-
MD5
0d819bbc31ae6f0fbd8fc1f359e8a566
-
SHA1
727be4d55b05dabdadf454366a3b729f6f055fec
-
SHA256
ade29640aacd15158cad35009b647053f5adce201b41fb0486623de4b2a72aae
-
SHA512
9c3cc2f8270074a03132fdfc5eaca2b7549e98d1cc3fac9cb205a9e0419bdef8ac3d6c061c5e2288d44b56836773fc51930d3db672e318e5eee8fbbb7449c1bd
-
SSDEEP
1536:gDqS/XCEYgC67HJsXFLtrRfqsn7KwbiIEMBoFHIvDcIf13:DkXY67HJslfVbiouFHIgQ3
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4380 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
Executes dropped EXE 1 IoCs
pid Process 4380 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
resource yara_rule behavioral2/memory/2232-0-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2232 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2232 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 4380 0d819bbc31ae6f0fbd8fc1f359e8a566.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2232 wrote to memory of 4380 2232 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 17 PID 2232 wrote to memory of 4380 2232 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 17 PID 2232 wrote to memory of 4380 2232 0d819bbc31ae6f0fbd8fc1f359e8a566.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exe"C:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exeC:\Users\Admin\AppData\Local\Temp\0d819bbc31ae6f0fbd8fc1f359e8a566.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4380
-