Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 15:00

General

  • Target

    ee156b59e6503366a39c9d477685b17b7f5a15b6d1a85af984773e482afefd97.exe

  • Size

    368KB

  • MD5

    57cc3439c007691907c9e574e95456d0

  • SHA1

    7e76f315b530496cb8ff69d513bc3637a87a638b

  • SHA256

    ee156b59e6503366a39c9d477685b17b7f5a15b6d1a85af984773e482afefd97

  • SHA512

    d8013943414307ac2475edd59e4c410e95f31c3571ee56b0147c9472d0ad9a237950c256f65d39b701010a4aadee7675f50c00c913e8768e6207dfcff9468a8b

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRqk:352T3siXei5bcmP9JfUjW

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee156b59e6503366a39c9d477685b17b7f5a15b6d1a85af984773e482afefd97.exe
    "C:\Users\Admin\AppData\Local\Temp\ee156b59e6503366a39c9d477685b17b7f5a15b6d1a85af984773e482afefd97.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:544
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:4896

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\$$$$$.bat

      Filesize

      264B

      MD5

      a84cd317ca7b5f6fc79457a5864002fc

      SHA1

      7656e92fea69bdfc00c121761189be9b4be4eb5a

      SHA256

      a9cba0271bc81a760c7eaad7f5008b8b57f7f6e0a7761a363fd3646570506e36

      SHA512

      022caff281911babbf847be30eca6283db33990cbef0fc8a3a5f430c8c9683fcf924163ba21686af8850d82d525a334fe6b32bf160e01c8a2747472595c449e2

    • memory/544-132-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/544-133-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/544-135-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB