Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2022, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe
Resource
win10v2004-20220901-en
General
-
Target
6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe
-
Size
14.0MB
-
MD5
e12238fc76b29eb30317212d9f41986b
-
SHA1
5498a41f089770d55afd1b4247fcf3f6e5a6f806
-
SHA256
6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d
-
SHA512
36c8f593fd66b8a28843d403ec8494ccc863210c30417cb723a5a0d024d2164c66aaa63b969dacdb4c70b6d2f679dbdb2d1f4a4d1049d2926ba35e136f35d8ca
-
SSDEEP
393216:WwumP+jlbByxkkBLQQ47HrUzRl1Bt4m+eyzncs:oZdU9BkQ4zr0l1z4sOn1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2640 6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2640 2324 6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe 82 PID 2324 wrote to memory of 2640 2324 6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe 82 PID 2324 wrote to memory of 2640 2324 6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe"C:\Users\Admin\AppData\Local\Temp\6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\is-1II67.tmp\6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.tmp"C:\Users\Admin\AppData\Local\Temp\is-1II67.tmp\6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.tmp" /SL5="$901C2,13976401,742912,C:\Users\Admin\AppData\Local\Temp\6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.exe"2⤵
- Executes dropped EXE
PID:2640
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-1II67.tmp\6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.tmp
Filesize2.4MB
MD5728563602d503a6f2c7c9b8fbbcbeac3
SHA189d59ff64df72235a97bf4bb6dc3540cb472824a
SHA256544c0c5adc6fe8a37fdd1de17315c53daf3316f4a7c389dd427adce76af6c281
SHA512eb09f7463a3b537eec23195b6ea79ce0a0bfb16981a215639c7089fda2a83cafd1035e0d72d91c7eb8c2761c08f30541f770ee6a695818c372ac32667fb1cd7f
-
C:\Users\Admin\AppData\Local\Temp\is-1II67.tmp\6782ba2bfd2e449b8426aee68e72dfbd0991c5b66cc5f649c9fad83be9253f9d.tmp
Filesize2.4MB
MD5728563602d503a6f2c7c9b8fbbcbeac3
SHA189d59ff64df72235a97bf4bb6dc3540cb472824a
SHA256544c0c5adc6fe8a37fdd1de17315c53daf3316f4a7c389dd427adce76af6c281
SHA512eb09f7463a3b537eec23195b6ea79ce0a0bfb16981a215639c7089fda2a83cafd1035e0d72d91c7eb8c2761c08f30541f770ee6a695818c372ac32667fb1cd7f