Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 19:57
Static task
static1
Behavioral task
behavioral1
Sample
36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe
Resource
win10v2004-20220812-en
General
-
Target
36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe
-
Size
299KB
-
MD5
3f38c5790ae830a0dee41dcb932f8a6e
-
SHA1
00d9945ee514191f7533dd9dca97e126f6bc6fd3
-
SHA256
36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4
-
SHA512
a86e3a74c9c5d71314bfc7113d6a9d4c1282bff0c9aa7a17cbe4f4338b85c1e7be4d67baed5d283b2086fce0b8243b1047f21f162e92a037b0c82381d36039a3
-
SSDEEP
6144:T1JyF+1ApsZPrnLSnfeb7n4rhK1SraH8cu9nN6c:T1LAmLSnf27YK1iO83
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3772 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4068 set thread context of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 set thread context of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4068 wrote to memory of 3280 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 81 PID 4068 wrote to memory of 3280 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 81 PID 4068 wrote to memory of 3280 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 81 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 4068 wrote to memory of 2556 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 83 PID 3280 wrote to memory of 4596 3280 cmd.exe 84 PID 3280 wrote to memory of 4596 3280 cmd.exe 84 PID 3280 wrote to memory of 4596 3280 cmd.exe 84 PID 4596 wrote to memory of 4544 4596 net.exe 85 PID 4596 wrote to memory of 4544 4596 net.exe 85 PID 4596 wrote to memory of 4544 4596 net.exe 85 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86 PID 4068 wrote to memory of 3772 4068 36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe"C:\Users\Admin\AppData\Local\Temp\36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:4544
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:2556
-
-
C:\Users\Admin\AppData\Local\Temp\36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exeC:\Users\Admin\AppData\Local\Temp\36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe2⤵
- Executes dropped EXE
PID:3772
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\36dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4.exe
Filesize299KB
MD53f38c5790ae830a0dee41dcb932f8a6e
SHA100d9945ee514191f7533dd9dca97e126f6bc6fd3
SHA25636dfa3751418263029d2584f59f9c93a7e9802f4c41e097e4302fcec15554fa4
SHA512a86e3a74c9c5d71314bfc7113d6a9d4c1282bff0c9aa7a17cbe4f4338b85c1e7be4d67baed5d283b2086fce0b8243b1047f21f162e92a037b0c82381d36039a3