Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
196s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 11:16
Static task
static1
Behavioral task
behavioral1
Sample
c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe
Resource
win10v2004-20221111-en
General
-
Target
c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe
-
Size
1.3MB
-
MD5
1c9a3e46cf19eda0eff658f207b3f7e9
-
SHA1
299aacd70b2a474587c338a9a38e2acef53c78a2
-
SHA256
c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02
-
SHA512
487961a08fa84c58e767573fb1c8e44d9003cb27251df31aa71d0c4f2da18d8a9fc2385c4c280918cbf96b15e79b688ded96ae8d4d3db751e87c1005f4239628
-
SSDEEP
24576:CQimIasLCfOzC8peyzxB54wnJo46ce6a3Y95TqRSLzytwaGAMBTlP0QjcpMXVJoT:C9ZasLQ8peyNr3X6ceH305ORImtyAGpk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4052 c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2652 wrote to memory of 4052 2652 c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe 82 PID 2652 wrote to memory of 4052 2652 c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe 82 PID 2652 wrote to memory of 4052 2652 c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe"C:\Users\Admin\AppData\Local\Temp\c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\is-IPQGJ.tmp\c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.tmp"C:\Users\Admin\AppData\Local\Temp\is-IPQGJ.tmp\c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.tmp" /SL5="$A004C,1074155,56832,C:\Users\Admin\AppData\Local\Temp\c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.exe"2⤵
- Executes dropped EXE
PID:4052
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-IPQGJ.tmp\c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.tmp
Filesize691KB
MD59303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-IPQGJ.tmp\c66f95fa67da2e06165fb210526b3e398860da91d5cb9051e978e91fcbce5d02.tmp
Filesize691KB
MD59303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f