Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 19:26

General

  • Target

    90f09983676505ffc86f6701ee626c0bdaf7c36f58a82345a78880e562f2f556.exe

  • Size

    2.3MB

  • MD5

    05ec6ba261ca50632e26f9acc7646711

  • SHA1

    ecb4a1cdaa032a0bab9d5c0aab1679f383da298a

  • SHA256

    90f09983676505ffc86f6701ee626c0bdaf7c36f58a82345a78880e562f2f556

  • SHA512

    a2e30973c014f142e61bbe4184b711b7fe6b24dcd3fc7e31e6fb3653a12657b44dfcd5bd17ea0d5f4533d9969b3525f1f70f1affdbf8947cb8f60058c9b0b9d1

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90f09983676505ffc86f6701ee626c0bdaf7c36f58a82345a78880e562f2f556.exe
    "C:\Users\Admin\AppData\Local\Temp\90f09983676505ffc86f6701ee626c0bdaf7c36f58a82345a78880e562f2f556.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:4644

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\$$$$$.bat

      Filesize

      264B

      MD5

      f7d8dcb84ff851d17d3c31bfe2ff5351

      SHA1

      99eefb38b1fbd3c1c80bbbc6305431ae87e30ee2

      SHA256

      d31600e77896eb3ed3849cf6b5e34f422eed9930694b07bbf0fc26bc50f2e5b7

      SHA512

      e03f85128e9ba2111c40bad414b61ae893257e93dfc9d1e41e001b059306d916a76405549a1749b04d38d63a6172e3045086b96308734d6d5f6de38128e90978

    • memory/2280-132-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/2280-133-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/2280-135-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB