Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 12:57

General

  • Target

    b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe

  • Size

    249KB

  • MD5

    4011c591946de4c19898e1c5e54f0aa4

  • SHA1

    5210204058d35f1c53cd278eee34a5b6f327e9df

  • SHA256

    b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2

  • SHA512

    b9a6e72c0e3948c8f8e585390857d4e9eeedac3d13bb3e6b459f232abac0ff5b3818836c4f8417dbbff2d032e276c08fca3be054b07dd0cd605f3d5645e311a5

  • SSDEEP

    6144:eWq8/eR6p0yN90QE1BRYU+d0rwqR6M3hIPk:L/eBy905RP+d0Eq48N

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:2484
      • C:\Users\Admin\AppData\Local\Temp\b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe
        "C:\Users\Admin\AppData\Local\Temp\b9cc26f6cc30942c0f54134fd8ff95c87d0c63a74bc57c6724603ec63e4d94e2.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4088
          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe
            "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1424

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe

      Filesize

      364KB

      MD5

      a4a0b5864d177694528dc6fdd80b091d

      SHA1

      e00a83525b26cfeb8fee5e9dc20aceef4b809458

      SHA256

      de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb

      SHA512

      e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe

      Filesize

      364KB

      MD5

      a4a0b5864d177694528dc6fdd80b091d

      SHA1

      e00a83525b26cfeb8fee5e9dc20aceef4b809458

      SHA256

      de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb

      SHA512

      e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\15911.exe

      Filesize

      364KB

      MD5

      a4a0b5864d177694528dc6fdd80b091d

      SHA1

      e00a83525b26cfeb8fee5e9dc20aceef4b809458

      SHA256

      de91bc1712e52bc0faa976700ed5a2152a3a466e2ba46a684fe189d414b239bb

      SHA512

      e7f3a8ece722f8fefe7e95dc71fe9004c112d302a63e3924d22a2c89a2af333151cd48c9842c136929cdf9392417f893953bbed4dfdc2e727e21a7fb62161955

    • memory/0-144-0x0000000000400000-0x0000000000408960-memory.dmp

      Filesize

      34KB

    • memory/0-141-0x0000000000400000-0x0000000000408960-memory.dmp

      Filesize

      34KB

    • memory/0-143-0x0000000000400000-0x0000000000408960-memory.dmp

      Filesize

      34KB

    • memory/0-146-0x0000000000400000-0x0000000000408960-memory.dmp

      Filesize

      34KB

    • memory/1424-138-0x0000000000400000-0x0000000000409000-memory.dmp

      Filesize

      36KB

    • memory/1424-145-0x0000000000400000-0x0000000000408960-memory.dmp

      Filesize

      34KB

    • memory/1424-147-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/1424-149-0x0000000010000000-0x0000000010013000-memory.dmp

      Filesize

      76KB

    • memory/2484-148-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

      Filesize

      28KB