Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2022, 01:11

General

  • Target

    633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe

  • Size

    2.0MB

  • MD5

    65790c132b9be132b3ef592ccb57c720

  • SHA1

    bd6265715b57c7b25cba5a4daa82c2150b467e49

  • SHA256

    633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560

  • SHA512

    09ab14b4738dd6e70511b71965bf831de951ec66294efaee7149655687ceaac9683860f919fc5100b5bc1ffb79725925503bd9c293510853ca0bfe2c4760f6da

  • SSDEEP

    24576:GKB58mnEzeDI4SY2SNxSuYPveP2HSC5Y+1YhL7:bqmEBoFP2y1+1

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
    "C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
      633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4764
      • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
        633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
          633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
            633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2072
            • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
              633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:5072
              • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
                633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M
                7⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:3420
                • C:\Users\Admin\AppData\Local\Temp\633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe
                  633fab8d11eda81bd6ad49861f1720e858b354d13ecad308e309d2a4b5235560.exe M
                  8⤵
                    PID:4612

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Log\log.txt

      Filesize

      84B

      MD5

      7d637ae73aecbc3c95aa3cb5fa422d0f

      SHA1

      afb40776f6563bed8460e9cc93f6489b82b2cd38

      SHA256

      3d84eee4d18c0a38204ea5f4154049d6e69f75520d9ba2f82c31f2fd0fe30d10

      SHA512

      74d2bea1d115d01997921a66fcfb75560770eba58615f79c71350e0b83e25efe62317990a83389ab827d3140cc1d0d837e35e950e398f55f045a2fc4a5b4ef15

    • C:\Users\Admin\AppData\Local\Temp\Log\log.txt

      Filesize

      126B

      MD5

      c46abf06731263e8a0b3214c3c77311b

      SHA1

      0dd38a2174663b577e1d7eda15e64835a9d792d6

      SHA256

      eab11e1098341133577c9ab40660550a25754be4d5c0832e8989836953186597

      SHA512

      3fc8a9c5d81cbfc2d2391e609952dfea3b3cb2c520ac8e808db1f6205d6703a604e00675395b862ed1f8c7fd8243549825bd58d128ec20e7b79dcd77e6a905ea

    • C:\Users\Admin\AppData\Local\Temp\Log\log.txt

      Filesize

      168B

      MD5

      f6deb266f36182f5afe152405f29ec00

      SHA1

      4db10482bd3167dfc0a5a8b9238c80b81db102de

      SHA256

      cb6c06b386307186bd78c2492be3d39f47336ce84a54a82bb82e5727f8f8d2b5

      SHA512

      1ebaf47455c9f9d792460c2b6d3232492cba3da77a695a014d85cc5a088a59127526173cbe7fe37629c2a1ac2c2fb265662cfa41b914230a00a4f7cc68ddb72a

    • C:\Users\Admin\AppData\Local\Temp\Log\log.txt

      Filesize

      210B

      MD5

      dc3b36ecfeb685abe5993f06d8378481

      SHA1

      d98e5169230a959fcd8bbbec28db2ced9614c7ef

      SHA256

      5f5f15dc17867564e811431edc9828e03fd2ae3832bb621dcf5d6162027b4799

      SHA512

      5a316aee08580198996bac857f6b03e9c4116006b814b56eb8148c0ab79770280ae039fbc1135023ae985ed826902e3255bf46d59cd8708a97782c2c3ecbebdb

    • C:\Users\Admin\AppData\Local\Temp\Log\log.txt

      Filesize

      252B

      MD5

      363d733c527290f35411a5ac7da3a4c8

      SHA1

      25d72f560eb249429a2a16a328f17af91a8c59f7

      SHA256

      645810eb232af260b927c75ed0df1d01211706373100f196f890d626f93af03c

      SHA512

      70fb3f702bb6572817a7df8b1bb64cd6af8f1470528f81123b4035a11f1524670ff5854c3318021738c56eb3053bc5f0513990943768c94d4e8b4af5d3a67db9

    • C:\Users\Admin\AppData\Local\Temp\Log\log.txt

      Filesize

      294B

      MD5

      f536fd60d4d0ef8353b5f52d93af7627

      SHA1

      bc5666110997906d2b76c5754fcc73cab274871f

      SHA256

      1aa7527609291ba049f87fb986936cb6afeed0a988817b342c70076ce47dc62c

      SHA512

      64a9a28a146e91e247ac0481bca88bc65035298ff541c1e8b0ffcc9ebaa445103a63a7e062048faccf2da35aa2a3715f459350a69f3489e249741ee9d571ea9c