Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 20:20
Static task
static1
Behavioral task
behavioral1
Sample
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe
Resource
win10v2004-20240226-en
General
-
Target
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe
-
Size
14.8MB
-
MD5
79a7cb9c405655a7f033f95a9895b389
-
SHA1
35ed873cc61caea5658411679a7f42f303f18fc4
-
SHA256
cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c
-
SHA512
a145f903e283fb5ccc4c4624d717d6e6de7c42eff1bce4ca95eab7937b41a0222fbc244703a5bb0dd841e36cb30d45630ce356ba8e27dd4177eb896facf5feec
-
SSDEEP
196608:sIer08mDn8g8NSHdoH8W3vA/loXvp4Pb8Ph5r/7B1KJV:eT7EBW3YtoXv6IhJ7m
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/528-1-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-0-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-2-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-3-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-6-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-8-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-10-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-12-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-15-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-17-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-19-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-21-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-23-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-25-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-27-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-29-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-32-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-35-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-37-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-39-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-41-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-47-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral2/memory/528-49-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wy.txt cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 528 cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe 528 cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe 528 cf9cf207149da32442a6da09dd48a362bd0b1c3fd2e6a78a058bff7f6042f66c.exe