Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

5b5b7e4755...80.exe

windows7-x64

8

5b5b7e4755...80.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    217s
  • max time network
    236s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 14:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.exe

  • Size

    3.4MB

  • MD5

    a5a10e8eb2c52a1f9af76325a44196a1

  • SHA1

    3ba8df2da028a9b2f0c2241ebb35148d848bc281

  • SHA256

    5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080

  • SHA512

    cdcf55cd8bf921f21bdeabb4948655c1b09005a077ee74c3028b4cd59661afe21bbcd09e72645565f4c3dccfea4551eb2a00ee93556949deb95c3af9c8cb0741

  • SSDEEP

    98304:YQPSIebPZtykO+h2I+qSZ/qB0tdvDwHiu:04B+h2I4/qydLwHiu

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.exe
    "C:\Users\Admin\AppData\Local\Temp\5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Users\Admin\AppData\Local\Temp\is-L9FKL.tmp\5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-L9FKL.tmp\5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.tmp" /SL5="$B0042,3098663,236544,C:\Users\Admin\AppData\Local\Temp\5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4768

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-L9FKL.tmp\5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.tmp
    Filesize

    1.2MB

    MD5

    2884636b36e2dbafc566c1640bf31d38

    SHA1

    2f33a26e42a19c94cc9d98599f19329029e8f02d

    SHA256

    1159cfb49a597c2fb388ee466fa6576a527f3ed9ecc51012bdbf7057371b0698

    SHA512

    030cacad059859580aa3d254cb4fa3aa61daf977cc2ffdc22009c736ec07bb43df1fa83e3b399a83edc400f9bf94d7944a18761c6928462039c0a2fc5138769d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-L9FKL.tmp\5b5b7e4755aff9367b1e5c6ce176031bbfb01bd72ac91cd7ce5b463615649080.tmp
    Filesize

    1.2MB

    MD5

    2884636b36e2dbafc566c1640bf31d38

    SHA1

    2f33a26e42a19c94cc9d98599f19329029e8f02d

    SHA256

    1159cfb49a597c2fb388ee466fa6576a527f3ed9ecc51012bdbf7057371b0698

    SHA512

    030cacad059859580aa3d254cb4fa3aa61daf977cc2ffdc22009c736ec07bb43df1fa83e3b399a83edc400f9bf94d7944a18761c6928462039c0a2fc5138769d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-PN2AL.tmp\CallbackCtrl.dll
    Filesize

    4KB

    MD5

    f07e819ba2e46a897cfabf816d7557b2

    SHA1

    8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

    SHA256

    68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

    SHA512

    7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-PN2AL.tmp\ItDownload_wex.dll
    Filesize

    200KB

    MD5

    5841c3c749ff25672f41b1a9390577d5

    SHA1

    f41db5a882a1c92396df4b60e5d775bd0603d9a7

    SHA256

    6a08b7327bffc6e2df2ccee81a8a17722b830e6a4ad794350e542ea955ed1d19

    SHA512

    386717b0684ea61205b28b51318eb4d1fe95c33c5e96354ab51167cd5355e5a62b82a350ffad0e2ff9d5eb60ada777446c0f43e72fa7ceb5a3ab32a1408ec579

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-PN2AL.tmp\ItDownload_wex.dll
    Filesize

    200KB

    MD5

    5841c3c749ff25672f41b1a9390577d5

    SHA1

    f41db5a882a1c92396df4b60e5d775bd0603d9a7

    SHA256

    6a08b7327bffc6e2df2ccee81a8a17722b830e6a4ad794350e542ea955ed1d19

    SHA512

    386717b0684ea61205b28b51318eb4d1fe95c33c5e96354ab51167cd5355e5a62b82a350ffad0e2ff9d5eb60ada777446c0f43e72fa7ceb5a3ab32a1408ec579

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-PN2AL.tmp\botva2.dll
    Filesize

    35KB

    MD5

    0177746573eed407f8dca8a9e441aa49

    SHA1

    6b462adf78059d26cbc56b3311e3b97fcb8d05f7

    SHA256

    a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

    SHA512

    d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-PN2AL.tmp\botva2.dll
    Filesize

    35KB

    MD5

    0177746573eed407f8dca8a9e441aa49

    SHA1

    6b462adf78059d26cbc56b3311e3b97fcb8d05f7

    SHA256

    a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

    SHA512

    d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

    Download Submit

  • memory/3492-138-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

    Download

  • memory/3492-132-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

    Download

  • memory/3492-134-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

    Download

  • memory/4768-141-0x0000000003470000-0x00000000034A6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/4768-144-0x00000000044F0000-0x00000000044FE000-memory.dmp

    Filesize

    56KB

    Download