Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
03/12/2022, 20:33
General
-
Target
eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe
-
Size
230KB
-
MD5
2c192f76425e966ae698a84130dc89f2
-
SHA1
6bbcb0c953c15b11f7489a6d976b20a75f64d54c
-
SHA256
eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268
-
SHA512
43b730ea0c7b0fed79230917dfd18f3418a3f749c03d1a5f3ba8cea3b4b954833984f0c60db96d17c2baa4c84e991c84a37ee1f72d864a2c48dee43568d91d8e
-
SSDEEP
3072:epvmvakjLm7PR5Q3k3vHjNr0eOGjIUi/cDhn0y24ywvDDjbngcQVS+1aA6:epWjkP/ZHjN9Njv7jbnZWS+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe"C:\Users\Admin\AppData\Local\Temp\eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Cwozia.exeC:\Windows\Cwozia.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230KB
MD52c192f76425e966ae698a84130dc89f2
SHA16bbcb0c953c15b11f7489a6d976b20a75f64d54c
SHA256eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268
SHA51243b730ea0c7b0fed79230917dfd18f3418a3f749c03d1a5f3ba8cea3b4b954833984f0c60db96d17c2baa4c84e991c84a37ee1f72d864a2c48dee43568d91d8e
-
Filesize
230KB
MD52c192f76425e966ae698a84130dc89f2
SHA16bbcb0c953c15b11f7489a6d976b20a75f64d54c
SHA256eb139e9f7b1095c9b4932eed0b6e42590ffe1373c7bc288c94621f11999ea268
SHA51243b730ea0c7b0fed79230917dfd18f3418a3f749c03d1a5f3ba8cea3b4b954833984f0c60db96d17c2baa4c84e991c84a37ee1f72d864a2c48dee43568d91d8e
-
Filesize
426B
MD5ef51402ab808274fcd413abb3f32d0f1
SHA184edee3fcae710f365b40650615a25c03aa972c0
SHA256059e3cc5da0eaa72ec22c551c6d36781e57e47c3b4c50e53f74f9825a287a66c
SHA5121097073ec6b9ce6547ba1d416d301c98ea5510fbebb1c6b0a09f8d066cb191c4a4561afa1e04281b7221f9c4eab4b9df86d695f15cdee8f3d022ed3f83942ba1
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB