Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe
Resource
win10v2004-20240226-en
General
-
Target
8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe
-
Size
1008KB
-
MD5
016c4e63b7cafb4567029337d3736782
-
SHA1
9bf7f4e83ff114ca6684673e27f081e07d7de7a4
-
SHA256
8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3
-
SHA512
80d65fbbc9e17af627db1e17d50357a375b3ad8e82f9c6a87146cbdc1b8e49094763c4a876e07bea80a90054c09ea5ee1391c8d1ac930f572d700c66a9312e1d
-
SSDEEP
12288:yCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga8D0oeE2Bf4:yCdxte/80jYLT3U1jfsWaK/2BfX/Q
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe 3048 8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe"C:\Users\Admin\AppData\Local\Temp\8d8ee75eb4c5142e152dae5e2e062c0b3e850014c8568e5fcf77e8ffcc3e44c3.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3048