Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/10/2022, 22:19
Static task
static1
Behavioral task
behavioral1
Sample
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
Resource
win10v2004-20220812-en
General
-
Target
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe
-
Size
51KB
-
MD5
83ac4fd06cf50d1a9f28a5c8a0ae59c0
-
SHA1
0671385798daf15a238325225df13d44ac1ac03c
-
SHA256
93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82
-
SHA512
acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee
-
SSDEEP
1536:UF+qxQcJxJljitFbOlFu2a+PpcVioN43:ObxJT9m4lFuH+ci
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3016 servet.exe 1808 servet.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\servet.exe 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe File opened for modification C:\Windows\SysWOW64\servet.exe 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe File created C:\Windows\SysWOW64\Deledomn.bat 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe File opened for modification C:\Windows\SysWOW64\servet.exe servet.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4644 set thread context of 2088 4644 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 81 PID 3016 set thread context of 1808 3016 servet.exe 83 -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4644 wrote to memory of 2088 4644 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 81 PID 4644 wrote to memory of 2088 4644 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 81 PID 4644 wrote to memory of 2088 4644 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 81 PID 4644 wrote to memory of 2088 4644 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 81 PID 4644 wrote to memory of 2088 4644 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 81 PID 2088 wrote to memory of 3016 2088 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 82 PID 2088 wrote to memory of 3016 2088 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 82 PID 2088 wrote to memory of 3016 2088 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 82 PID 3016 wrote to memory of 1808 3016 servet.exe 83 PID 3016 wrote to memory of 1808 3016 servet.exe 83 PID 3016 wrote to memory of 1808 3016 servet.exe 83 PID 3016 wrote to memory of 1808 3016 servet.exe 83 PID 3016 wrote to memory of 1808 3016 servet.exe 83 PID 2088 wrote to memory of 4708 2088 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 85 PID 2088 wrote to memory of 4708 2088 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 85 PID 2088 wrote to memory of 4708 2088 93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe"C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exeC:\Users\Admin\AppData\Local\Temp\93dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82.exe2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\servet.exeC:\Windows\system32\servet.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\servet.exeC:\Windows\SysWOW64\servet.exe4⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Deledomn.bat3⤵PID:4708
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248B
MD53b2f3aa7050fdf00f09470c09fac254e
SHA1a69a9aba69194d0f77beb1a2162d2a82c436ec87
SHA256119bda802b5861b8159a33ff7e9e87591d4dbf092a3adef808369c3a26379ec6
SHA512e81947b4c96a1bdca8a2d3e9ef56f24027d7d2d6e72ea43d02a5e53a2eec8eafbc5636ad772dae4ea34a309407b557e3bf9872e177ff9f200550daa1d316b1df
-
Filesize
51KB
MD583ac4fd06cf50d1a9f28a5c8a0ae59c0
SHA10671385798daf15a238325225df13d44ac1ac03c
SHA25693dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82
SHA512acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee
-
Filesize
51KB
MD583ac4fd06cf50d1a9f28a5c8a0ae59c0
SHA10671385798daf15a238325225df13d44ac1ac03c
SHA25693dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82
SHA512acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee
-
Filesize
51KB
MD583ac4fd06cf50d1a9f28a5c8a0ae59c0
SHA10671385798daf15a238325225df13d44ac1ac03c
SHA25693dc7fa0d3aadf7a15d931703b8c8e8b85bc3e39a279d9fd38dc45b96fd16f82
SHA512acd9ea6e88a928042ed0dd986d75b40c4f297c4a519b29cefe672fc55b36f59e6758ef8a5a61e1090d353fa33b44cdd285dc0146b0f07ba67aa5d87e91449fee