Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 17:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65a7b20cf373dd4e6cf8eaaa50b5de65.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
65a7b20cf373dd4e6cf8eaaa50b5de65.exe
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
65a7b20cf373dd4e6cf8eaaa50b5de65.exe
-
Size
39KB
-
MD5
65a7b20cf373dd4e6cf8eaaa50b5de65
-
SHA1
4b232888f028b6887b4c6c8ac957160638a51d95
-
SHA256
bbb4b3d3d717b5ab719f2056dd52f9a081d5ab269aca8d2d182634932aac8ee1
-
SHA512
00ee66579f5fa943f32db51175a01c478f1282479c210d689258250481638912180d13913d9b71a52269782d9e6b876c0ae957b33b3720f32a99dc4715881ac0
-
SSDEEP
768:pAh0wTSECfXJ879YIb0CvcchZqTEz2n27YT8tq:qvkBySRCvmYzmDT8tq
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3632 set thread context of 4288 3632 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 52 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4288 3632 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 52 PID 3632 wrote to memory of 4288 3632 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 52 PID 3632 wrote to memory of 4288 3632 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 52 PID 3632 wrote to memory of 4288 3632 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 52 PID 3632 wrote to memory of 4288 3632 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 52 PID 3632 wrote to memory of 4288 3632 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 52 PID 4288 wrote to memory of 3596 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 49 PID 4288 wrote to memory of 3596 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 49 PID 4288 wrote to memory of 3596 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 49 PID 4288 wrote to memory of 3596 4288 65a7b20cf373dd4e6cf8eaaa50b5de65.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exe"C:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exe²C:\Users\Admin\AppData\Local\Temp\65a7b20cf373dd4e6cf8eaaa50b5de65.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3596