Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
12a2b6c279a648577e1ce5fa1a35afc3.exe
Resource
win7-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
12a2b6c279a648577e1ce5fa1a35afc3.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
12a2b6c279a648577e1ce5fa1a35afc3.exe
-
Size
604KB
-
MD5
12a2b6c279a648577e1ce5fa1a35afc3
-
SHA1
d9f25ad9e5705246278df8aab3762c0a5be7fc64
-
SHA256
3e8b1ea84ad2d991323a9df69f5bedece5252c0f7cb83139a25f9441ca98a131
-
SHA512
36444c069c0763c22f06ab71570eb9818db937c978324a94610dbc37a3362ddbb4596cee4e75415c8193dcb02bdb721c6e197dd82590ad8eb85280e16283dcfe
-
SSDEEP
12288:iTC7O4L2AudlNj0E852PaPuou8UYYZY/BwTDKlu/cQ/4M:iTCK4L0Nj0l5x1u8IZYpwTDKlu/cs
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 4052 12a2b6c279a648577e1ce5fa1a35afc3.exe 4640 12a2b6c279a648577e1ce5fa1a35afc3.exe 2636 12a2b6c279a648577e1ce5fa1a35afc3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4052 wrote to memory of 4640 4052 12a2b6c279a648577e1ce5fa1a35afc3.exe 89 PID 4052 wrote to memory of 4640 4052 12a2b6c279a648577e1ce5fa1a35afc3.exe 89 PID 4052 wrote to memory of 4640 4052 12a2b6c279a648577e1ce5fa1a35afc3.exe 89 PID 4052 wrote to memory of 2636 4052 12a2b6c279a648577e1ce5fa1a35afc3.exe 90 PID 4052 wrote to memory of 2636 4052 12a2b6c279a648577e1ce5fa1a35afc3.exe 90 PID 4052 wrote to memory of 2636 4052 12a2b6c279a648577e1ce5fa1a35afc3.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe"C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exestart2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4640
-
-
C:\Users\Admin\AppData\Local\Temp\12a2b6c279a648577e1ce5fa1a35afc3.exewatch2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2636
-