Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 13:57
Behavioral task
behavioral1
Sample
1ac1714caca6c2009500fdc2eacbad59.exe
Resource
win7-20231129-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ac1714caca6c2009500fdc2eacbad59.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
1ac1714caca6c2009500fdc2eacbad59.exe
-
Size
5.3MB
-
MD5
1ac1714caca6c2009500fdc2eacbad59
-
SHA1
6527b9f43762aca5361e5a0c5f6cfeabb18e619e
-
SHA256
89b6954bd3d8cfeeea40b7a22dfe8b183aa0c7fe4b9950f219b2488e7962b0ec
-
SHA512
c96125da421c9f7adf8e65b718606c23a9945b17b20ddd88a797fd36d2c6b5d6d3b3456e0b94e129b8885a6fc7bf6fd0a7eae511f56cd03ec48652eacdda90fd
-
SSDEEP
98304:+FdZH/+/R/Pintur6tvy1aMUvzp+umg+piur6tvy1aMUp:w+/R/Pnr6oEMyor6oEMe
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1776 1ac1714caca6c2009500fdc2eacbad59.exe -
Executes dropped EXE 1 IoCs
pid Process 1776 1ac1714caca6c2009500fdc2eacbad59.exe -
resource yara_rule behavioral2/memory/1596-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral2/memory/1776-13-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1596 1ac1714caca6c2009500fdc2eacbad59.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1596 1ac1714caca6c2009500fdc2eacbad59.exe 1776 1ac1714caca6c2009500fdc2eacbad59.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1776 1596 1ac1714caca6c2009500fdc2eacbad59.exe 20 PID 1596 wrote to memory of 1776 1596 1ac1714caca6c2009500fdc2eacbad59.exe 20 PID 1596 wrote to memory of 1776 1596 1ac1714caca6c2009500fdc2eacbad59.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe"C:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exeC:\Users\Admin\AppData\Local\Temp\1ac1714caca6c2009500fdc2eacbad59.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1776
-