Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 12:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
stager.exe
Resource
win7-20231215-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
stager.exe
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
stager.exe
-
Size
965KB
-
MD5
528182768aa1bd3fa9493ad43aa031c3
-
SHA1
40e36425cbae0dfa0c9851f1a18a1899f625ed30
-
SHA256
db1de8a7407d2c63c71e96085d1f52bffd8db45beb5500333e9fbe5434ad3cae
-
SHA512
e6251280fde8b8a0ef83811ab8c2ae8a99d53d3b3f192c7e331d7d86fab9e9974ee3f54bf1541ca018f8662d4e5a4b6e3c7b024dfadb4cc67d0ab85c93f3c749
-
SSDEEP
12288:QWsoMmEJ20MDsmRCDvL2nE/lS/MxSMZGlsok7XYZnxpyFmruMI4oV:d4mEJWDWDvL2nE/lS/M7SxpyYuM
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1548 created 3468 1548 stager.exe 49 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1548 stager.exe 1548 stager.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1548 stager.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1548 wrote to memory of 1364 1548 stager.exe 92 PID 1548 wrote to memory of 1364 1548 stager.exe 92 PID 1548 wrote to memory of 1364 1548 stager.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\stager.exe"C:\Users\Admin\AppData\Local\Temp\stager.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1548
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3468
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:1364
-