Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
136s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13/05/2020, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe
-
Size
88KB
-
MD5
a4e1caab1b9642ef645b6549ca09d303
-
SHA1
da0cd782f32088c0df8cd62deda1c61b4cedd6fb
-
SHA256
855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3
-
SHA512
7bfac7c52b00928a28dbcdf73f50401e1be2177540c7473de20f8058e49f46eb6d508eb9eac090c2b25d61e507e839da1404b4da3f66fc10e54797023d7659ae
Score
6/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 PID 288 wrote to memory of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 288 set thread context of 108 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 24 -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 288 855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe 108 RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:288 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\855dcd368dbb01539e7efa4b3fefa9b56d197db87b1ba3ede5e1f95927ea2ca3.bin.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:108
-