Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 12:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce1ada4a0788c4e0278d69c1f905af66.exe
Resource
win7-20240221-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ce1ada4a0788c4e0278d69c1f905af66.exe
Resource
win10v2004-20240226-en
4 signatures
150 seconds
General
-
Target
ce1ada4a0788c4e0278d69c1f905af66.exe
-
Size
75KB
-
MD5
ce1ada4a0788c4e0278d69c1f905af66
-
SHA1
aac2bb26c51742c6eea7ee99f9cf670e2160fcde
-
SHA256
aebb3d877abe8e9f6340e286a185b90ee7f28fb9956a18d6e7e77c51d2c3cbaa
-
SHA512
fa07c79150158b41e597e18b90e8deeb20f69ed936fc2d85c50fbf09af8e3731b1563ac6b22202c31fdf15bde36f69736cc2715690c0d2b0a82dde5f5bee90a7
-
SSDEEP
1536:AFpf6+EY0XI3S2fIyZGMpjL9VazmZLzbujWnXwKRgHzNg+UTgd1CP:mpC+EY04QdejLvazmVqKOHBg+UTgKP
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2044 set thread context of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2768 ce1ada4a0788c4e0278d69c1f905af66.exe 2768 ce1ada4a0788c4e0278d69c1f905af66.exe 2768 ce1ada4a0788c4e0278d69c1f905af66.exe 2768 ce1ada4a0788c4e0278d69c1f905af66.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2044 ce1ada4a0788c4e0278d69c1f905af66.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 PID 2044 wrote to memory of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 PID 2044 wrote to memory of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 PID 2044 wrote to memory of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 PID 2044 wrote to memory of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 PID 2044 wrote to memory of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 PID 2044 wrote to memory of 2768 2044 ce1ada4a0788c4e0278d69c1f905af66.exe 89 PID 2768 wrote to memory of 3472 2768 ce1ada4a0788c4e0278d69c1f905af66.exe 57 PID 2768 wrote to memory of 3472 2768 ce1ada4a0788c4e0278d69c1f905af66.exe 57 PID 2768 wrote to memory of 3472 2768 ce1ada4a0788c4e0278d69c1f905af66.exe 57 PID 2768 wrote to memory of 3472 2768 ce1ada4a0788c4e0278d69c1f905af66.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\ce1ada4a0788c4e0278d69c1f905af66.exe"C:\Users\Admin\AppData\Local\Temp\ce1ada4a0788c4e0278d69c1f905af66.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\ce1ada4a0788c4e0278d69c1f905af66.exeC:\Users\Admin\AppData\Local\Temp\ce1ada4a0788c4e0278d69c1f905af66.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768
-
-