Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 17:25
Behavioral task
behavioral1
Sample
loader.exe
Resource
win7-20240903-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
loader.exe
Resource
win10v2004-20240802-en
3 signatures
150 seconds
General
-
Target
loader.exe
-
Size
11.6MB
-
MD5
3fb6f7382cd42db4ae7e5d2dceabde54
-
SHA1
9113821a3227d7c417835c8d437540d7dc25478f
-
SHA256
f2bce8af8313bd95710966e90e3c5de80728dda7e9b97a26b2e1396e797aef06
-
SHA512
1e4686f9f02def2147deb748cffb04af01530bbb010e86eeaf79b182538bb4d1a1ce5df28084166138eddda789e788e4f7080b12375f7e390317b31e0429b6a0
-
SSDEEP
196608:6mu6lFEZs7cq3YvPIrublgpFV16dXL9ygAfWTwTkZDh0SySu42QcGlV:6t6lOZs7Y3yWgpFX6dh1AfNTkZDmXIh
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/4132-3-0x00007FF732870000-0x00007FF733E93000-memory.dmp vmprotect behavioral2/memory/4132-8-0x00007FF732870000-0x00007FF733E93000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4132 loader.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4132 loader.exe 4132 loader.exe