Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1151s -
max time network
1142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 14:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
SearchFilterHost.exe
Resource
win7-20240903-en
windows7-x64
2 signatures
1200 seconds
Behavioral task
behavioral2
Sample
SearchFilterHost.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
1200 seconds
General
-
Target
SearchFilterHost.exe
-
Size
1.3MB
-
MD5
963032914cce47a62034777a8cb7ab1c
-
SHA1
9e2bb12a1851e35f5bc09dcd248b91d22515ace9
-
SHA256
a15aad03c7d939baa3e149b8f41e7c0421986a1a1758ccac135ce097db34cf6b
-
SHA512
c100f3f0c75143883a6077c49d4f5cdfae5ac1ef3b84be96acbbfd346807cdc42cce81a330faf3700dbd850d590a0c8ebb73be6013ceea642865ec6f035761b2
-
SSDEEP
24576:LRk9s/X7y1j3jNPnHHgyV+3ED6T9wno0G9e/5AQrg:Fbzy1DRHAORiwo
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe 5032 SearchFilterHost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5032 SearchFilterHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1444 winver.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89 PID 5032 wrote to memory of 1444 5032 SearchFilterHost.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"C:\Users\Admin\AppData\Local\Temp\SearchFilterHost.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\System32\winver.exe"C:\Windows\System32\winver.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1444
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
600B
MD58268c6ce0ef60d4032b99640e65a0de5
SHA19af2408e775493f75083467278b49dc20242f767
SHA2569a05e008d25804e3c2946d220895e1a1455e08b01db12147fcf690f996229e18
SHA512a1cc9b360cb80f3ae601b13b7d06deedc0047f85d44e2c550f1250fe5f8ddf6b26970df119508b64904dabbe94226cd361806168fa425b5fa4ed65e5fb074ad1