Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
08/06/2024, 16:30
240608-tz8nxsdc8v 808/06/2024, 16:18
240608-tscmxadb9t 508/06/2024, 02:27
240608-cxkqmsff7v 5Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2024, 16:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
DisplyyMapper.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
DisplyyMapper.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
DisplyyMapper.exe
-
Size
13.6MB
-
MD5
69ecc872198af00462376f967c35dccd
-
SHA1
fb974099b3e01f541659895fe50221c760a5f381
-
SHA256
b46ce5e37a3a0de709e057b3f3629182570068340cef8a1c1d2aeaa65dc35174
-
SHA512
cd874c72f8a414d473a7f51953ad96cf9fff29c9ba46281eb12f1c261af712243695c0b3f2dca1c634984347368f7e0e6cd69ef4686c0432ef9b753547279ba0
-
SSDEEP
196608:bybt7UZOGLHah64d9cD498zVztRLKSaqmD39fZFS4z+D63tkV46SlmBGcmpr:b2QOoHaht9598zpttm5xA4WUw46SEmR
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe 1816 DisplyyMapper.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DisplyyMapper.exe"C:\Users\Admin\AppData\Local\Temp\DisplyyMapper.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1816
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4740