Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    180s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 09:35 UTC

General

  • Target

    eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe

  • Size

    95KB

  • MD5

    0424755b0000ad2a6abfd172ad76bb30

  • SHA1

    1dfeeb2206f2e1e365a4e01b124eb4479eeecd37

  • SHA256

    eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366

  • SHA512

    b0bcd319c9fbe9b7666f9830ed38b8c27d3810b0996417501a6f3a429d52525c193938b03aba50def8b21f56b9feb537a46c9edf08a05db52e6874c25ec99f4d

  • SSDEEP

    1536:0VyU+KE8EME7C/MSPt9IhffgZB+ST7plGvAX9dst2euj/yQ9QEDkOZxyTl+5FMh1:WaKE8EME7mM24IZB/T7plGYUNbXOvu

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe
    "C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3376
    • C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe
      "C:\Users\Admin\AppData\Local\Temp\eef0896f3528f202ebb4304e7f9ef82b26358ea3346160936739e3de66fd8366.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4364
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
        • Adds Run key to start application
        PID:4412

Network

    No results found
  • 13.69.239.72:443
    322 B
    7
  • 50.57.223.115:443
    svchost.exe
    260 B
    5
  • 198.245.63.31:8080
    svchost.exe
    260 B
    5
  • 50.57.223.115:443
    svchost.exe
    260 B
    5
  • 87.117.242.2:8080
    svchost.exe
    260 B
    5
  • 77.72.150.225:8080
    svchost.exe
    260 B
    5
  • 5.157.82.99:8080
    svchost.exe
    208 B
    4
No results found

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3376-136-0x0000000000010000-0x000000000002B000-memory.dmp

    Filesize

    108KB

  • memory/4364-133-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4364-134-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4364-135-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4364-139-0x0000000000010000-0x000000000002B000-memory.dmp

    Filesize

    108KB

  • memory/4412-138-0x0000000000960000-0x000000000096E000-memory.dmp

    Filesize

    56KB

  • memory/4412-140-0x0000000000900000-0x0000000000911000-memory.dmp

    Filesize

    68KB

  • memory/4412-141-0x0000000000ED0000-0x0000000000F50000-memory.dmp

    Filesize

    512KB

  • memory/4412-142-0x0000000000ED0000-0x0000000000F50000-memory.dmp

    Filesize

    512KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.