Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

3

SakuraaCas..._1.exe

windows7-x64

5

SakuraaCas..._1.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2024, 17:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SakuraaCastingModLoader_1.exe

  • Size

    13.8MB

  • MD5

    1ed98e2aa5685c02c6e901100353e556

  • SHA1

    5ac2b2ae4f91122a1d1722a4dd7e535077885a10

  • SHA256

    9fd82b4b337ef2dadc453aa0365b3f3fb372de592df7bae33a041e4f2698b54c

  • SHA512

    bcd43029cce581b3e776be5d1a58c89d0a752a12b04c2ac63939a9f94fd3190538cc873f6e0ff1910858c70d8c97f192ad2c5c39caa6bc94dcabde423024c945

  • SSDEEP

    393216:fftZJkZJH84iNGcGOrsN1Do840BvsDv2A7S:HtZJaJ7is3OYNTBK1S

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SakuraaCastingModLoader_1.exe
    "C:\Users\Admin\AppData\Local\Temp\SakuraaCastingModLoader_1.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:324
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2900,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
    1⤵
      PID:4412

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/324-0-0x00007FF60B37D000-0x00007FF60BBA4000-memory.dmp

      Filesize

      8.2MB

      Download

    • memory/324-1-0x00007FF81DC10000-0x00007FF81DC12000-memory.dmp

      Filesize

      8KB

      Download

    • memory/324-3-0x00007FF60B370000-0x00007FF60C96C000-memory.dmp

      Filesize

      22.0MB

      Download

    • memory/324-2-0x00007FF81DC20000-0x00007FF81DC22000-memory.dmp

      Filesize

      8KB

      Download

    • memory/324-6-0x00007FF60B370000-0x00007FF60C96C000-memory.dmp

      Filesize

      22.0MB

      Download

    • memory/324-7-0x00007FF60B37D000-0x00007FF60BBA4000-memory.dmp

      Filesize

      8.2MB

      Download

    • memory/324-8-0x00007FF60B370000-0x00007FF60C96C000-memory.dmp

      Filesize

      22.0MB

      Download