Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 01:29

General

  • Target

    b5e9c5b11f7b8ad4b95ba5a0a50e3ce6e20a5946f765711a75b8019e2cceb09a.exe

  • Size

    649KB

  • MD5

    0fc99ee25756d010c29e2ca27967f286

  • SHA1

    396f140df596844eca63bfcca500b11d52a0aba4

  • SHA256

    b5e9c5b11f7b8ad4b95ba5a0a50e3ce6e20a5946f765711a75b8019e2cceb09a

  • SHA512

    c995854e9d1fc370d0d0abdd8530cebfc134dd757eefd1f4b8f3321f8d672952c5c4a791783595fb4e63abbd0717e2c343ca177bc104dd05e8bb5d56e68c4696

  • SSDEEP

    3072:7+ZvkWp8qX96QfCDpMqrT4GmdVM3bXKCKk3T1a/PTYhA7Jf22QA6Ivv1tH/nSrNF:aZmqt6Qyiy3b6CR10TY8JOArF9S9

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5e9c5b11f7b8ad4b95ba5a0a50e3ce6e20a5946f765711a75b8019e2cceb09a.exe
    "C:\Users\Admin\AppData\Local\Temp\b5e9c5b11f7b8ad4b95ba5a0a50e3ce6e20a5946f765711a75b8019e2cceb09a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:4248

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\$$$$$.bat

      Filesize

      264B

      MD5

      035589f3f5d8fc361afbf3181e79ec67

      SHA1

      5b9eddab7725829270125a20ddcba3c54578396c

      SHA256

      fb383adc40c086bcda3f22b4db183d6385f56f4c32414fb258664ca4417ce736

      SHA512

      9a8838066a69895dde41a08c9645abbc4b9e8887c7106b733a96b798f89c47f691d2fd853dbecb500496d6f737912e1c98e4444b3ab6f0edfe6a398a0864d859

    • memory/1264-132-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1264-133-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/1264-135-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB