Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 23:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ad71435f04e9259c8e1f704c1678a5e.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
8ad71435f04e9259c8e1f704c1678a5e.exe
Resource
win10v2004-20231222-en
4 signatures
150 seconds
General
-
Target
8ad71435f04e9259c8e1f704c1678a5e.exe
-
Size
45KB
-
MD5
8ad71435f04e9259c8e1f704c1678a5e
-
SHA1
be14fb26aaa3b1f49fa9c7bd973753c49efd73a6
-
SHA256
7410668fa18c8cee23c14b28e2b562dfff02940d03b3f38dd7155c29ca2e2fc5
-
SHA512
e81507e74051a56d2fc29a0e5b86ce74310ca9a5a40918e6187e24405d9a6f0dcbdfc77a2962754fcce41ff9555a6b7e7f179ae3d780fc9c3f597769f2e9b4ad
-
SSDEEP
768:ryYVE+sIYv7xezYJctfo1VoTg+ZKp1U6XDF93AIU2J+5X6GCPqhXs7Ulf7DRZg:ryY+dVv7xbJctKoTc1rD220RtCPq7JW
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2728 set thread context of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4500 8ad71435f04e9259c8e1f704c1678a5e.exe 4500 8ad71435f04e9259c8e1f704c1678a5e.exe 4500 8ad71435f04e9259c8e1f704c1678a5e.exe 4500 8ad71435f04e9259c8e1f704c1678a5e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2728 8ad71435f04e9259c8e1f704c1678a5e.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2728 wrote to memory of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 PID 2728 wrote to memory of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 PID 2728 wrote to memory of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 PID 2728 wrote to memory of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 PID 2728 wrote to memory of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 PID 2728 wrote to memory of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 PID 2728 wrote to memory of 4500 2728 8ad71435f04e9259c8e1f704c1678a5e.exe 85 PID 4500 wrote to memory of 3436 4500 8ad71435f04e9259c8e1f704c1678a5e.exe 21 PID 4500 wrote to memory of 3436 4500 8ad71435f04e9259c8e1f704c1678a5e.exe 21 PID 4500 wrote to memory of 3436 4500 8ad71435f04e9259c8e1f704c1678a5e.exe 21 PID 4500 wrote to memory of 3436 4500 8ad71435f04e9259c8e1f704c1678a5e.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\8ad71435f04e9259c8e1f704c1678a5e.exe"C:\Users\Admin\AppData\Local\Temp\8ad71435f04e9259c8e1f704c1678a5e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\8ad71435f04e9259c8e1f704c1678a5e.exe"C:\Users\Admin\AppData\Local\Temp\8ad71435f04e9259c8e1f704c1678a5e.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4500
-
-