Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2022, 07:28
Static task
static1
Behavioral task
behavioral1
Sample
bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe
Resource
win10v2004-20220812-en
General
-
Target
bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe
-
Size
412KB
-
MD5
09128909376c75f71f2b0a8a009d834f
-
SHA1
f664a49af4dd77a43b569c03b97442cbb71033f6
-
SHA256
bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a
-
SHA512
1ea8f01a18b3111f2c2e3302fadd423058c8f79e4071bfbc873047ee7f4a0c2dcdaa9d9228e35a78484f8b1f4bab8b70eb76400e21b9685017c669701a9825e7
-
SSDEEP
6144:g8f6p0X4qumAxSRLnoPhL20gKc1ilJPZNkCLNr3Kr/u2x58uncuCKWYyYCcFV4ry:qp06UI9gKcaLLSdCKqYCemfxDIz
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\drivers\etc\s2er333vice9.ini bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe -
Executes dropped EXE 1 IoCs
pid Process 4296 commandline.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created \??\c:\program files\Realplayer\Swedish\commandline.exe bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2276 bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe 2276 bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe 2276 bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe 2276 bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe 4296 commandline.exe 4296 commandline.exe 4296 commandline.exe 4296 commandline.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2276 wrote to memory of 4296 2276 bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe 80 PID 2276 wrote to memory of 4296 2276 bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe 80 PID 2276 wrote to memory of 4296 2276 bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe"C:\Users\Admin\AppData\Local\Temp\bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe"1⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\program files\Realplayer\Swedish\commandline.exe"c:\program files\Realplayer\Swedish\commandline.exe" "33201"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4296
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD57bcc24b0bb1256c969a12c6e5f8db904
SHA1f738e2432ea275ce1e2980584821857a99ac817d
SHA256b8a0e0a57f3b8bbdae2baaccc8058f9527a4178ce6cd0f92de86a650a8bf094c
SHA51205e6bd76c81d0dec69a720e45aa189c654e8a6caba7ee084c9711cff54bc8f215fb0bb90740ee59e3775398f06d63362ca0bb14650b0210bea2b9254a8ea424d
-
Filesize
412KB
MD57bcc24b0bb1256c969a12c6e5f8db904
SHA1f738e2432ea275ce1e2980584821857a99ac817d
SHA256b8a0e0a57f3b8bbdae2baaccc8058f9527a4178ce6cd0f92de86a650a8bf094c
SHA51205e6bd76c81d0dec69a720e45aa189c654e8a6caba7ee084c9711cff54bc8f215fb0bb90740ee59e3775398f06d63362ca0bb14650b0210bea2b9254a8ea424d