Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 01:43
Behavioral task
behavioral1
Sample
3b935cb31b127c2bc8796768d4b7cdf4.exe
Resource
win7-20231215-en
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b935cb31b127c2bc8796768d4b7cdf4.exe
Resource
win10v2004-20231222-en
6 signatures
150 seconds
General
-
Target
3b935cb31b127c2bc8796768d4b7cdf4.exe
-
Size
133KB
-
MD5
3b935cb31b127c2bc8796768d4b7cdf4
-
SHA1
2ab89c1654634c4a74ba7013e8acdaab312d177d
-
SHA256
f5306041db24dd2a18dedae5ccb36216e1dba583393fd9a4f16e5ddb6d04f651
-
SHA512
9ef6071592698e18db713db038ae0dd74e15d7e9faa4aa80b2ec06bcdb88177c6aba4936bceab2fb81e088ece09cfbba1aa09d3685d90b54dd2d13734e69b39d
-
SSDEEP
3072:lzLJ9UP+QyX3JF83QkpXA3qgn/a/y+goutgDQ:ln/Ubw3JF8AkpDJH6gDQ
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2236 3b935cb31b127c2bc8796768d4b7cdf4.exe -
Executes dropped EXE 1 IoCs
pid Process 2236 3b935cb31b127c2bc8796768d4b7cdf4.exe -
resource yara_rule behavioral2/memory/4668-0-0x0000000000400000-0x0000000000486000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4668 3b935cb31b127c2bc8796768d4b7cdf4.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4668 3b935cb31b127c2bc8796768d4b7cdf4.exe 2236 3b935cb31b127c2bc8796768d4b7cdf4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4668 wrote to memory of 2236 4668 3b935cb31b127c2bc8796768d4b7cdf4.exe 19 PID 4668 wrote to memory of 2236 4668 3b935cb31b127c2bc8796768d4b7cdf4.exe 19 PID 4668 wrote to memory of 2236 4668 3b935cb31b127c2bc8796768d4b7cdf4.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b935cb31b127c2bc8796768d4b7cdf4.exe"C:\Users\Admin\AppData\Local\Temp\3b935cb31b127c2bc8796768d4b7cdf4.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\3b935cb31b127c2bc8796768d4b7cdf4.exeC:\Users\Admin\AppData\Local\Temp\3b935cb31b127c2bc8796768d4b7cdf4.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2236
-