Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2023, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
3bfa52461d5d13exeexe_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
3bfa52461d5d13exeexe_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
3bfa52461d5d13exeexe_JC.exe
-
Size
428KB
-
MD5
3bfa52461d5d1345b308c7800e76978c
-
SHA1
9b708a88233dbb5723d8673c6f229c78abd62fa7
-
SHA256
77665707295b431394791d6f8ab131c648b78e0471f1c8000bec02b4688d5a8d
-
SHA512
13b40ad3dd4e33d276656931874bd4ea439272ae8f204517752713f30af827b96beed8e10d91d8445a6f12f1d9f5a924b053e675fd7a75b0c1c8995a74630f38
-
SSDEEP
12288:Z594+AcL4tBekiuKzErUAgtXuYy+UDOXWMl178ql:BL4tBekiuVrUJFy3DOX/T78q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2032 F6D3.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2032 2068 3bfa52461d5d13exeexe_JC.exe 86 PID 2068 wrote to memory of 2032 2068 3bfa52461d5d13exeexe_JC.exe 86 PID 2068 wrote to memory of 2032 2068 3bfa52461d5d13exeexe_JC.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bfa52461d5d13exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\3bfa52461d5d13exeexe_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\3bfa52461d5d13exeexe_JC.exe 8FF60253FD42C2F16F3744B02E22CBD4E7E28F3929C17FFF1F2C909F732E14CEF884329B540FC9E602EDA64881253A260587B090F7A476B0D673F8B2386003582⤵
- Executes dropped EXE
PID:2032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
428KB
MD5126a40c1bee367c39299d0a7f98a4ec1
SHA163ceb6e7411655dfdd0fab68add0323cfc24ea48
SHA2567d8d6fb8803adc126b93b9f7def36a42be95fa8b838770fdd9d0097a30443789
SHA5126e0cbdcb08fd65a9ac2124f1e19405ae285a47cf8eef79a0ec06747ea89e1a0c8e8262bcfdf4df5a56d784af1f1cb4b5a9963f638882643e17c44bc9d06f7bb8
-
Filesize
428KB
MD5126a40c1bee367c39299d0a7f98a4ec1
SHA163ceb6e7411655dfdd0fab68add0323cfc24ea48
SHA2567d8d6fb8803adc126b93b9f7def36a42be95fa8b838770fdd9d0097a30443789
SHA5126e0cbdcb08fd65a9ac2124f1e19405ae285a47cf8eef79a0ec06747ea89e1a0c8e8262bcfdf4df5a56d784af1f1cb4b5a9963f638882643e17c44bc9d06f7bb8