Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 12:34
Behavioral task
behavioral1
Sample
CreateStudio/CreateStudio.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CreateStudio/CreateStudio.exe
Resource
win10v2004-20240226-en
General
-
Target
CreateStudio/CreateStudio.exe
-
Size
6.3MB
-
MD5
7235f1d04f41d635dedcf6795c9fd286
-
SHA1
3fe3eb8d4cdbe2cd059e883f476a5effed813ac2
-
SHA256
4a74e3ab6273d6efb2ed30159879fab136177eee62bbcfa0863105b0868fcabf
-
SHA512
bc5d016fa6e8e7f1142ab495fc12ca08962890ef9d28e51ec79c8ab976a52ca7ead6220e62fb208347f085f613901d1fb308c15d4af6a049802f7628458874af
-
SSDEEP
196608:FR4jYdQmRJ8dA6lXCy1ArqkVpKCX+PrF4ZIeghiBV7I:vWYdQuslXrAZYCuPJOIegR
Malware Config
Signatures
-
Loads dropped DLL 14 IoCs
pid Process 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe 1456 CreateStudio.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 1456 CreateStudio.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3300 wrote to memory of 1456 3300 CreateStudio.exe 88 PID 3300 wrote to memory of 1456 3300 CreateStudio.exe 88 PID 1456 wrote to memory of 1576 1456 CreateStudio.exe 89 PID 1456 wrote to memory of 1576 1456 CreateStudio.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\CreateStudio\CreateStudio.exe"C:\Users\Admin\AppData\Local\Temp\CreateStudio\CreateStudio.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\CreateStudio\CreateStudio.exe"C:\Users\Admin\AppData\Local\Temp\CreateStudio\CreateStudio.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵PID:1576
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
71KB
MD54f174a1036cadc4165030fec9ec7d11f
SHA1d66057e883c7593e559f9410871781bd3e89a038
SHA25697318e5271ba7c76d510c35141187deaae92dcfaf92c855fe77d16d2e05ac6e9
SHA5122abe257425983db6ecd2a4c302cb91ae7b7d928d6854a27c6d2aa8c5492340be62c47798ec569f9f50d02ae627411a2621846f1c303e9331071c8de4dd1e05e2
-
Filesize
81KB
MD523dce6cd4be213f8374bf52e67a15c91
SHA1dfc1139d702475904326cb60699fec09de645009
SHA256190ade9f09be287fcc5328a6a497921f164c5c67e6d4fcdcb8b8fd6853b06fe2
SHA512c3983e2af9333a8538f68f7048b83c1bb32219c13adac26fd1036c3dc54394a3e2c1e4c0219232badd8e2c95418019b9b22906bdb23a19601447573a93c038a0
-
Filesize
120KB
MD52abeebe2166921a4d8b67b8f8a2b878a
SHA121f0fff00cba76a0ea471c3e05179e4b4cc1ebd0
SHA2567adcea3a5568752a6050610cfbe791a4f8186aaaa002f916b88560a1ddab580f
SHA51254c802d532c9ef9f3668d5e9bf23b69a58f87ec545af7fd4eab1055bfb8ee66481f361458076a364a17ddddd6550a70f5442c2bbe6562553472c0839346b1a35
-
Filesize
9KB
MD5ab757a4a64cabd0486704a5884276309
SHA16395a32c13fc70a8c605052849cd964bf2941ffd
SHA256f258b9b178f087951eff007e77b5ba29cbf359e3432e519c63732fa693efa02d
SHA512994cb7b425b150d84cdae9475f84c7dcad0c4b557fd96f229d49dd005fb61d1ba945e50a8b1bbf10716240f79c9471f054057111a00578150fa02201fc385d77
-
Filesize
60KB
MD5477dd76dbb15bad8d77b978ea336f014
SHA13ee56105b71c3676c2e4fdaeb7d561f68cf03b9e
SHA25623063b56aa067c3d4a79a873d4db113f6396f3e1fe0af4b12d95d240c4cf9969
SHA5123a97c0a860e3cf97ae53b1f75623c52dcad9b64b70d329511781058a3477bc9faea32c2b8dc4852e7a8c4b0a02c8e3d027cf27e91187069cb35fb4d78d4e73ef
-
Filesize
154KB
MD5401eca12e2beb9c2fbf4a0d871c1c500
SHA17cfc2f94ade6712dd993186041e54917a3dd15ae
SHA2565361824ddac7c84811b80834eca3acb5fe6d63bf506cf92baf5bd6c3786bf209
SHA512da6b63ba4e2e7886701ff2462c11dd989d8a3f2a2a64bb4f5eed7271b017d69e6cfe7347e3d515fdf615ec81d2bb58367bcc1533b8a5073edf9474a3759f6d7c
-
Filesize
1.1MB
MD5352364081ca2bc10f3df4469f85c2867
SHA157afb0cd49df30d9cd88ae3df5b900e063f2d84a
SHA2568d8f34f18648f880ee2e1d679197ef1421f6e809ad860943bd1ba37b5f683437
SHA51255d19ac0daab1e7109e848d33e8613b771d7ca68219fc3aa043ae63360b546db3c60f4aac22b2ac0d718e8ba77effd3d2b5770b1986416a40470c941d47c4138
-
Filesize
75KB
MD54ceb5b09b8e7dc208c45c6ac11f13335
SHA14dde8f5aa30bd86f17a04e09a792a769feb12010
SHA25671f014c3c56661ec93500db1d9f120e11725a8aedabc3a395658275710065178
SHA512858c271b32729762773562ab3dbda8021aa775ba4606f57e891be18d9fe27518a48db0811eff9aafe53fb44557186431c672bbec204fa17a8ae6b86765a02d07
-
Filesize
155KB
MD5dcb25c920292192dd89821526c09a806
SHA179c9af3a11b41d94728f274b45a7c61dc8bbf267
SHA2564e496cb3b89550cf5883d0b52f5f4660524969c7a5fa35a3b233df4f482d0482
SHA512ae4ed1a66eef0b0c474c6ee498cd1388ef41f3746905257c7f5c0f73abbe3262eb47bb5748d47d55f1bd376308335a089c2b4c15ffe5d7fc21f2a660a4a93ba4
-
Filesize
132KB
MD57da9da08f8c6671933ca78fe77be3a9b
SHA1e994e6a6103ac2e6a316ff8067a5d3405ac892cc
SHA256684455092236d70df4c076bdf096a037b4f011519f31344b228a3f02646a023b
SHA5126ca20a42e19f94420833673a7738dfb69c2b318519df61360f6f0ec0871b82763ce4f11b4168db8de80559f92e6f1eb449bb7227e4343791bd717d4ddd031cb6
-
Filesize
2.0MB
MD5b17fbaf40608078c0f2a524ce940611a
SHA102939c134bc94361084451194b6025604795d7ba
SHA25612a069d3ef87db3bd4e6b165f991bec51ceb426f955a852b8b047609eb2ad92b
SHA51289e3110b9b4a0277c6a251a817ec87de8e017d5121ec35939d0ecf06807ed90d192bd08970860da392ee0026cefd9aa37377c56b0fac4598eb36cc0fe8960ebc
-
Filesize
3.3MB
MD56f4b8eb45a965372156086201207c81f
SHA18278f9539463f0a45009287f0516098cb7a15406
SHA256976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
SHA5122c5c54842aba9c82fb9e7594ae9e264ac3cbdc2cc1cd22263e9d77479b93636799d0f28235ac79937070e40b04a097c3ea3b7e0cd4376a95ed8ca90245b7891f
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
686KB
MD58769adafca3a6fc6ef26f01fd31afa84
SHA138baef74bdd2e941ccd321f91bfd49dacc6a3cb6
SHA2562aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
SHA512fac22f1a2ffbfb4789bdeed476c8daf42547d40efe3e11b41fadbc4445bb7ca77675a31b5337df55fdeb4d2739e0fb2cbcac2feabfd4cd48201f8ae50a9bd90b
-
Filesize
2.5MB
MD540260cc0c72afc132e23b581d76d3c7f
SHA150387c393f65f8a1773efa7e846e95b49b95c7cd
SHA25659387e49bb7eacd204209f4cc3e480e4af047787d57596dd635105be964311e4
SHA512d2bc8739983e9336d888ff8dd3f54980b61326ef13e3ec8c2213407ef7243a879ce50cca1c32df9ed2c650a295c3f2c870176729f832dbe4eef0bba5d8e22770
-
Filesize
223KB
MD5de7a3ade246de448b2c55fb6551b1c38
SHA10693e6cc30c63029d7995e23249b07660a79cc7a
SHA256ee9ba4734a49d42984674dd9649b447c0027ad30ff6ec902907e7563ca54a6e4
SHA512e3b4d7100b2e646db179abf17b86d60b28495afd57174374eca61c633ec943c0a9fd14fcd04f004b5c1ab9d8393f65d8de4f63ec696e840089cc847b218ed2ff
-
Filesize
28KB
MD5a7863648b3839bfe2d5f7c450b108545
SHA110078d8edb2c46a2e74ec7680d2db293acc5731c
SHA2568b4b5d37b829ba885281134d9948f249e0ecd553ae72deda6a404619fdf4ccc5
SHA512a709865709abe0c39d68e2ced4aa4387cd173ea9aa0a04c9794733b5bf3584d50256a9f756fee1dec144a9d724b028264763196eeb7b89ab2697ff26d83db843
-
Filesize
1.1MB
MD5cf1eda3f804dfa64ac00cad29ab243e1
SHA13b0f08fa679227fa635490725e17460a9de8092d
SHA256a3aa957cf891a411a4e22e41aa4053265eccba4d47b5abe6475789ebba7fcca0
SHA5121ba213a7e5916fe628d80efdeade35de7db88cc8118f8ac348dc7f7a7c5977975c9cf63d774136259fc055790eb96644bde2ee19c044126f1d59d665e4bc8d97