Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2023, 20:54

General

  • Target

    5dee4c2abca557exeexeexeex.exe

  • Size

    411KB

  • MD5

    5dee4c2abca557b22f297a56195f8344

  • SHA1

    d2a8b535b6cf99814bee89f5e97c43d983f4994f

  • SHA256

    ac6639f64748b8db3d593dfc79926b57ae8af5683f99d0e3568929bd7600d7a1

  • SHA512

    599a1463e11cfdaef45b6288b9a67a93f382c0ef762aaa64ae2d47414ae4f4386302f492eae9a28b5da722cdcbb0d9d3271738643007ee8b2d3a8cc0ea19ee43

  • SSDEEP

    6144:gVdvczEb7GUOpYWhNVynE/mF6rNpewDMJ6ir2WpsHChLqH:gZLolhNVyEBNQsMJ6irv6C5qH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5dee4c2abca557exeexeexeex.exe
    "C:\Users\Admin\AppData\Local\Temp\5dee4c2abca557exeexeexeex.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\65FD.tmp
      "C:\Users\Admin\AppData\Local\Temp\65FD.tmp" --pingC:\Users\Admin\AppData\Local\Temp\5dee4c2abca557exeexeexeex.exe BDE8ECA16A6B3BE9366E8FDB421ADE93118A7436235FD8907713CD016E5B0237EBAFB45F8A9755335CC417E2C47B72184FAE29D32BF9BF5CD153DB0DBF282208
      2⤵
      • Executes dropped EXE
      PID:4864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\65FD.tmp

    Filesize

    411KB

    MD5

    4f39e5b9e3268854d37e893fc11683e9

    SHA1

    97d19ba07246cc820f7334c60b1f4cc265c7dd25

    SHA256

    b6fa3cc634afd082a5c23711243bf375c04cd6049de95e0a80f132a5a632208e

    SHA512

    a8e3ed061410ce22a0ca5c76c6f634596f467616d5dfb760e44a084392b7be5b9915a7a23fc2224a2c607a06e36daed76fa3d5de36696494eeeda6415b811dfb

  • C:\Users\Admin\AppData\Local\Temp\65FD.tmp

    Filesize

    411KB

    MD5

    4f39e5b9e3268854d37e893fc11683e9

    SHA1

    97d19ba07246cc820f7334c60b1f4cc265c7dd25

    SHA256

    b6fa3cc634afd082a5c23711243bf375c04cd6049de95e0a80f132a5a632208e

    SHA512

    a8e3ed061410ce22a0ca5c76c6f634596f467616d5dfb760e44a084392b7be5b9915a7a23fc2224a2c607a06e36daed76fa3d5de36696494eeeda6415b811dfb