Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
80s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2023, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
091herpaLM.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
091herpaLM.exe
Resource
win10v2004-20230220-en
General
-
Target
091herpaLM.exe
-
Size
165KB
-
MD5
def1e5c4a64d90b690668bc0330387a5
-
SHA1
294b8bc3dd3e5f2029b183b3ac3212c0b4bc38e1
-
SHA256
ffb9b3e3f65f587aab02594bcd002c724f8b1ad81bc6c38ab734f0d82123ae6d
-
SHA512
9ede6018a727066f7b29f7e2f996d03749d3f46fe0d6d5865878fa25ce65630db2d87857b2f978abaeae25938279a53c89bcd70a4b54f3bc2071ae0424081d6c
-
SSDEEP
3072:Yf+GYrgxI0c5XI/NklH0iNL2Sl8BJoNEWoY46Uolwe4Rh:ndr0I0c5XICuiNLnluOdohPolCR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4360 dqiawpkg.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4408 wrote to memory of 4360 4408 091herpaLM.exe PID 4408 wrote to memory of 4360 4408 091herpaLM.exe 84
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD55da8c98136d98dfec4716edd79c7145f
SHA1ed13af4a0a754b8daee4929134d2ff15ebe053cd
SHA25658189cbd4e6dc0c7d8e66b6a6f75652fc9f4afc7ce0eba7d67d8c3feb0d5381f
SHA5126e2b067760ec178cdcc4df04c541ce6940fc2a0cdd36f57f4d6332e38119dbc5e24eb67c11d2c8c8ffeed43533c2dd8b642d2c7c997c392928091b5ccce7582a