Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2023, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
5dee4c2abca557exeexeexeex.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
5dee4c2abca557exeexeexeex.exe
Resource
win10v2004-20230703-en
General
-
Target
5dee4c2abca557exeexeexeex.exe
-
Size
411KB
-
MD5
5dee4c2abca557b22f297a56195f8344
-
SHA1
d2a8b535b6cf99814bee89f5e97c43d983f4994f
-
SHA256
ac6639f64748b8db3d593dfc79926b57ae8af5683f99d0e3568929bd7600d7a1
-
SHA512
599a1463e11cfdaef45b6288b9a67a93f382c0ef762aaa64ae2d47414ae4f4386302f492eae9a28b5da722cdcbb0d9d3271738643007ee8b2d3a8cc0ea19ee43
-
SSDEEP
6144:gVdvczEb7GUOpYWhNVynE/mF6rNpewDMJ6ir2WpsHChLqH:gZLolhNVyEBNQsMJ6irv6C5qH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4864 65FD.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1612 wrote to memory of 4864 1612 5dee4c2abca557exeexeexeex.exe 83 PID 1612 wrote to memory of 4864 1612 5dee4c2abca557exeexeexeex.exe 83 PID 1612 wrote to memory of 4864 1612 5dee4c2abca557exeexeexeex.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dee4c2abca557exeexeexeex.exe"C:\Users\Admin\AppData\Local\Temp\5dee4c2abca557exeexeexeex.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp" --pingC:\Users\Admin\AppData\Local\Temp\5dee4c2abca557exeexeexeex.exe BDE8ECA16A6B3BE9366E8FDB421ADE93118A7436235FD8907713CD016E5B0237EBAFB45F8A9755335CC417E2C47B72184FAE29D32BF9BF5CD153DB0DBF2822082⤵
- Executes dropped EXE
PID:4864
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
411KB
MD54f39e5b9e3268854d37e893fc11683e9
SHA197d19ba07246cc820f7334c60b1f4cc265c7dd25
SHA256b6fa3cc634afd082a5c23711243bf375c04cd6049de95e0a80f132a5a632208e
SHA512a8e3ed061410ce22a0ca5c76c6f634596f467616d5dfb760e44a084392b7be5b9915a7a23fc2224a2c607a06e36daed76fa3d5de36696494eeeda6415b811dfb
-
Filesize
411KB
MD54f39e5b9e3268854d37e893fc11683e9
SHA197d19ba07246cc820f7334c60b1f4cc265c7dd25
SHA256b6fa3cc634afd082a5c23711243bf375c04cd6049de95e0a80f132a5a632208e
SHA512a8e3ed061410ce22a0ca5c76c6f634596f467616d5dfb760e44a084392b7be5b9915a7a23fc2224a2c607a06e36daed76fa3d5de36696494eeeda6415b811dfb