Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 07:41

General

  • Target

    bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468.exe

  • Size

    127KB

  • MD5

    6455373da16152426d34a86eb11f7a10

  • SHA1

    63865ef4466392f0377451aee098afe986c4a8b3

  • SHA256

    bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468

  • SHA512

    26042fb0f6ccb983dca7ad836ba665afe066a1c4305e140d7c036a72a2a381cb93c5efa08636cd0e55366d435cdc5342fa91b4b61ca40aeda479dba44331ae50

  • SSDEEP

    1536:l6u6YB56XJ6owvzbNfURp4VntUhtH7Vi4BhihkLewbAWHoKIObgtH5AXWn7eMsaq:l6uB28owvlrVnihVVi4HJLTsXpQl

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468.exe
    "C:\Users\Admin\AppData\Local\Temp\bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468.exe
      "C:\Users\Admin\AppData\Local\Temp\bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\syswow64\svchost.exe
        3⤵
        • Adds policy Run key to start application
        • Drops file in Program Files directory
        PID:3384

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468.exe

    Filesize

    127KB

    MD5

    6455373da16152426d34a86eb11f7a10

    SHA1

    63865ef4466392f0377451aee098afe986c4a8b3

    SHA256

    bd06c65007396a3315e45fffca0ac2ad542b939abce59f6b552308d106f50468

    SHA512

    26042fb0f6ccb983dca7ad836ba665afe066a1c4305e140d7c036a72a2a381cb93c5efa08636cd0e55366d435cdc5342fa91b4b61ca40aeda479dba44331ae50

  • memory/552-133-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/552-136-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/3384-138-0x0000000000240000-0x000000000024E000-memory.dmp

    Filesize

    56KB

  • memory/3384-139-0x0000000000F40000-0x0000000000F45000-memory.dmp

    Filesize

    20KB

  • memory/3384-140-0x0000000000F40000-0x0000000000F45000-memory.dmp

    Filesize

    20KB