Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2023, 06:34

General

  • Target

    winmail-reader-setup.exe

  • Size

    686KB

  • MD5

    420c65ee1fc0355890f0929ccec43e87

  • SHA1

    965e7e7d6ac9badfecc9bfbec579c9cb16856286

  • SHA256

    8613fd9a29079424a89f95d5c94b6a96cbff00f2afdca9842c1a5b65c909db3a

  • SHA512

    2466f2a4b7839f49b59c6a20470e5d5541caa06deddaada81ddb6905f65b60a1e98d2eb3798c96340a1dafe2f404d60df1050782f3d1160ac5191fa56ea3fa87

  • SSDEEP

    12288:qna96qurSKk/9iKWljB6kjWvEsmjjYVb6OORWjWOG/sLUSwA0pyHKWNjHP+4vqV7:qnakqur9k1uFB6kKvEMN6vRW5tJEHWZE

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\winmail-reader-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\winmail-reader-setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3996
    • C:\Users\Admin\AppData\Local\Temp\is-RGTUI.tmp\winmail-reader-setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-RGTUI.tmp\winmail-reader-setup.tmp" /SL5="$B0028,440482,59904,C:\Users\Admin\AppData\Local\Temp\winmail-reader-setup.exe"
      2⤵
      • Executes dropped EXE
      PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-RGTUI.tmp\winmail-reader-setup.tmp

    Filesize

    693KB

    MD5

    d652c5a969a492cb7fa096aec4a16736

    SHA1

    068b7c3064a4ca8d6f27e9606b0e98e10baa417b

    SHA256

    8d2d1d60c9ba416dca71172141778a1fa78be35ccc074f1c3158e3b89ca4ffb4

    SHA512

    8e47b75c7584f61661b7c09c2f13266d442c034b98cb4345762a25621339e776a397718f27c7626604676a83bd46be294a8d35791b38c250c90f7fa5b7d7dfc8

  • C:\Users\Admin\AppData\Local\Temp\is-RGTUI.tmp\winmail-reader-setup.tmp

    Filesize

    693KB

    MD5

    d652c5a969a492cb7fa096aec4a16736

    SHA1

    068b7c3064a4ca8d6f27e9606b0e98e10baa417b

    SHA256

    8d2d1d60c9ba416dca71172141778a1fa78be35ccc074f1c3158e3b89ca4ffb4

    SHA512

    8e47b75c7584f61661b7c09c2f13266d442c034b98cb4345762a25621339e776a397718f27c7626604676a83bd46be294a8d35791b38c250c90f7fa5b7d7dfc8

  • memory/1328-139-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/1328-146-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/1328-147-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/3996-133-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/3996-145-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB