Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
a322c96252d85b8b408def7646500029.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a322c96252d85b8b408def7646500029.exe
Resource
win10v2004-20240221-en
General
-
Target
a322c96252d85b8b408def7646500029.exe
-
Size
3.0MB
-
MD5
a322c96252d85b8b408def7646500029
-
SHA1
26f95f5273abbe7aa91c6615d7e113bedf9ee46e
-
SHA256
088cbe4387c2b6f462bd57b0d72f0a9b5ccf114c81abd55be8050b47dcd54789
-
SHA512
5634ef63724dd64f70cc3d87f87e760b7ffe79b14be41d7402d81eb42a3a0d83ad04b8a23346b4637e408065f390680533291a1e9fac2e6a49fa611901852adc
-
SSDEEP
24576:+7QFRUm/rCYAj8pXU+Cz/rVCY4C05XU+Czvm/rCYAj8pXU+CzQYAj8pXU+Cz/rVD:EQFRHrmQG+yrV2F2+zrmQG+tQG+yrVXT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1084 scvbdx.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1084 scvbdx.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1084 scvbdx.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1084 scvbdx.exe 1084 scvbdx.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1160 wrote to memory of 1084 1160 a322c96252d85b8b408def7646500029.exe 86 PID 1160 wrote to memory of 1084 1160 a322c96252d85b8b408def7646500029.exe 86 PID 1160 wrote to memory of 1084 1160 a322c96252d85b8b408def7646500029.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a322c96252d85b8b408def7646500029.exe"C:\Users\Admin\AppData\Local\Temp\a322c96252d85b8b408def7646500029.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\scvbdx.exeC:\Users\Admin\AppData\Local\Temp\scvbdx.exe -run C:\Users\Admin\AppData\Local\Temp\a322c96252d85b8b408def7646500029.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1084
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD572371c681f0961d8220454b2bc05e731
SHA159cf970cb43ca07709a774f86ed364a6b25fedc8
SHA25647fe2a4659798675ede393a7f8dc7475816915d82ac2dba1049eca5a08e886f6
SHA512caed45b1f1cd64888b0532b96fe9554b4bb0d913c82c17ff25e1fd624f2cc7c1b0e2ad3fea0d70a638eb6e059b10265c5541c9d34e28ace3f915a34ce6800ff1
-
Filesize
3.6MB
MD52fc4cb255e512f57bf0a8741ba9a3c1d
SHA143f7e11971fa4a2205c213bac6b244cb02933c59
SHA25621545060202fb4d04e8c417086a77ed74a68dd15f63a97a3762cc3c2c39c32d3
SHA5129a166219b9162047ae2f54dc6bd55c8821d9a886345969c92fc850f629e407cc71c6af3bf562324ef87d1becba3b8fa39f5310873640f537666903ecb6014cde