Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 13:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19d259f7a25f2487d4161eb70f7fa8be.exe
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
19d259f7a25f2487d4161eb70f7fa8be.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
19d259f7a25f2487d4161eb70f7fa8be.exe
-
Size
204KB
-
MD5
19d259f7a25f2487d4161eb70f7fa8be
-
SHA1
c59c48e4376342007f558bf1bc00f8d6a0a4f5f2
-
SHA256
42f93b69de546676814bce6ccf337b379e2c2942d0560a2e8f60f3a25a1cfef1
-
SHA512
3f4746f1df7f3d48544c6a1eee15f2a194d17578b335ad108297dbcc2e8f686da64c2a2a4ad8a9ff6ff93a5d6603fd6ed40dff2d3f5a0d2154e27e945b306d9d
-
SSDEEP
6144:ugP7FaPhWr97ASvBSoxTqTNn136MMo3WpidPf6AIIN7:ugjFihkhA6qZ13hHs8nnr7
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4640 set thread context of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1620 19d259f7a25f2487d4161eb70f7fa8be.exe 1620 19d259f7a25f2487d4161eb70f7fa8be.exe 1620 19d259f7a25f2487d4161eb70f7fa8be.exe 1620 19d259f7a25f2487d4161eb70f7fa8be.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4640 19d259f7a25f2487d4161eb70f7fa8be.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4640 wrote to memory of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 PID 4640 wrote to memory of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 PID 4640 wrote to memory of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 PID 4640 wrote to memory of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 PID 4640 wrote to memory of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 PID 4640 wrote to memory of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 PID 4640 wrote to memory of 1620 4640 19d259f7a25f2487d4161eb70f7fa8be.exe 90 PID 1620 wrote to memory of 3412 1620 19d259f7a25f2487d4161eb70f7fa8be.exe 44 PID 1620 wrote to memory of 3412 1620 19d259f7a25f2487d4161eb70f7fa8be.exe 44 PID 1620 wrote to memory of 3412 1620 19d259f7a25f2487d4161eb70f7fa8be.exe 44 PID 1620 wrote to memory of 3412 1620 19d259f7a25f2487d4161eb70f7fa8be.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\19d259f7a25f2487d4161eb70f7fa8be.exe"C:\Users\Admin\AppData\Local\Temp\19d259f7a25f2487d4161eb70f7fa8be.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\19d259f7a25f2487d4161eb70f7fa8be.exeC:\Users\Admin\AppData\Local\Temp\19d259f7a25f2487d4161eb70f7fa8be.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3412