Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
189286a6317594fa3f1e2adb1031ac11ef6ef83f85620b940480d251e138dab0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
189286a6317594fa3f1e2adb1031ac11ef6ef83f85620b940480d251e138dab0.exe
Resource
win10v2004-20240802-en
General
-
Target
189286a6317594fa3f1e2adb1031ac11ef6ef83f85620b940480d251e138dab0
-
Size
43KB
-
MD5
519fd3972499701079a5944a45a752c6
-
SHA1
05cb025b05ed4fbe77c4c40a106ed4c93b35274d
-
SHA256
189286a6317594fa3f1e2adb1031ac11ef6ef83f85620b940480d251e138dab0
-
SHA512
398f900547ff3d9a2d2cd9b557b6e477ebabc89fb202bc96be61c70a8e5de3c0ec2c7e65e770e9a75b8245fcc4a073d0abfcd17dcaf8af6c9d5449b2c88896cc
-
SSDEEP
768:ehv2STe0T7iJKtMIju34V/XmZ5SOnz8bKZFrw99qhEjKE/HzM8MLY0+UNvnWQ0tQ:eESTetAMIK95SOzQKZe995jX/HzM80Yg
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 189286a6317594fa3f1e2adb1031ac11ef6ef83f85620b940480d251e138dab0
Files
-
189286a6317594fa3f1e2adb1031ac11ef6ef83f85620b940480d251e138dab0.exe windows:4 windows x86 arch:x86
4c61a1bfb2b97c08f21a940f8b6d7be7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
LookupPrivilegeValueA
OpenProcessToken
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyA
AdjustTokenPrivileges
msvcrt
exit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
_exit
tolower
strstr
time
kernel32
GetProcAddress
GetCurrentProcess
CloseHandle
GetStartupInfoA
GetSystemDirectoryA
lstrcatA
GetModuleFileNameA
DeleteFileA
CopyFileA
CreateProcessA
GetVersionExA
BeginUpdateResourceA
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
VirtualFreeEx
WaitForSingleObject
CreateRemoteThread
WriteProcessMemory
CreateMutexA
GetModuleHandleA
VirtualAllocEx
OpenProcess
GetCurrentProcessId
EndUpdateResourceA
GetLastError
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
Sleep
LoadLibraryA
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ