Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 00:34
Static task
static1
Behavioral task
behavioral1
Sample
GNY.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
GNY.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
GNY.exe
-
Size
1.4MB
-
MD5
f01d597da787f36737a05798493a1dc8
-
SHA1
3e6493f777d272d865ec6cc4fc73c9d71731b5f5
-
SHA256
ec7bcf048cc605f66b9e2ce320784347a12f4fdefab250f2347bd521ec2ba361
-
SHA512
80d764213e4e69bb59aa0c9ca36e5d386210d9ff4f610908f43a43b4fda078800afadf5f00450d99e42151b7859b91735d165bdbca53d95229bc53afe7f81fd4
-
SSDEEP
24576:D3dhgAYmYqHU7pHYev00V6dCDdoVYdGp8VTALtMa6N:2mYqHU7pHYY00VcCDdowG3tMa6N
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4196 set thread context of 1700 4196 GNY.exe 88 -
Program crash 1 IoCs
pid pid_target Process procid_target 2624 4196 WerFault.exe 83 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe 4196 GNY.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4196 GNY.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4196 wrote to memory of 1700 4196 GNY.exe 88 PID 4196 wrote to memory of 1700 4196 GNY.exe 88 PID 4196 wrote to memory of 1700 4196 GNY.exe 88 PID 4196 wrote to memory of 1700 4196 GNY.exe 88 PID 4196 wrote to memory of 1700 4196 GNY.exe 88 PID 4196 wrote to memory of 1700 4196 GNY.exe 88 PID 4196 wrote to memory of 1700 4196 GNY.exe 88 PID 4196 wrote to memory of 1700 4196 GNY.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\GNY.exe"C:\Users\Admin\AppData\Local\Temp\GNY.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\ctfmon.exe"C:\Windows\SysWOW64\ctfmon.exe -p 1234"2⤵PID:1700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4196 -s 4962⤵
- Program crash
PID:2624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4196 -ip 41961⤵PID:2616