Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 14:33

General

  • Target

    0367a24b53248644cd59656c88f698a0a4f365a2ac8db4e083f5e0934b9a588a.exe

  • Size

    995KB

  • MD5

    62365d92f055f917b9f6ba84d54d2826

  • SHA1

    902f1a89bbd13ce3a3c56c6b1104a400ab90acee

  • SHA256

    0367a24b53248644cd59656c88f698a0a4f365a2ac8db4e083f5e0934b9a588a

  • SHA512

    8f2c6a45f754202ec73dc9aa295b72951816edef09c3030a59e1829b6472762dd7691a4efb21b83380e80cf3d12d777fb8aad918723c619bc1d4d96eb75029fe

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRqm:352T3siXei5bcmP9JfUjWU

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0367a24b53248644cd59656c88f698a0a4f365a2ac8db4e083f5e0934b9a588a.exe
    "C:\Users\Admin\AppData\Local\Temp\0367a24b53248644cd59656c88f698a0a4f365a2ac8db4e083f5e0934b9a588a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:1976

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\$$$$$.bat

      Filesize

      264B

      MD5

      7f4efe90568db92643057bc9d6a9d9b6

      SHA1

      1fdc3b03ff63f6826fd65ee2db01d1106ac38c17

      SHA256

      e37bff1ea512280190fc99e8470c3ad0b6781278cc77cf7425fe1330d5a2fc76

      SHA512

      1cd304728e43a8a96e38e01485f86120831ec2742ab08e6f436e01a93bdb7d317c535378e96d756a06fdbd383af49e90639f25ce36e8a9fec29b5055b0b585bb

    • memory/1080-132-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1080-133-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1080-135-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB