Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2023, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
Decent_Sampler-1.8.12.0-Windows.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Decent_Sampler-1.8.12.0-Windows.exe
Resource
win10v2004-20230703-en
General
-
Target
Decent_Sampler-1.8.12.0-Windows.exe
-
Size
31.7MB
-
MD5
1fb5e8893336b758740944ea0f2965a8
-
SHA1
8a849d422806fac01693ef44402bdf9ec14d34ba
-
SHA256
8ffc45ed98a4e16a0e2e58eb9e35f6f73a3a7520adb2e7e9360d7acead3a5f8c
-
SHA512
61acb91b0eaeb452604bcddf3004c37aafdd01d89b9532b40a4471a975414c3531eff9ae43243b1ccc418b64e59c5ae8d4bcebb6a7a0cd9874a7274d6537b44d
-
SSDEEP
786432:t+CMjkyOX0+Q/JQViulnYrsDDc4u3Mwh1+G1opCMi2KH:5GLGkWViu6I3Fw04oQMi
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4080 Decent_Sampler-1.8.12.0-Windows.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4168 wrote to memory of 4080 4168 Decent_Sampler-1.8.12.0-Windows.exe 86 PID 4168 wrote to memory of 4080 4168 Decent_Sampler-1.8.12.0-Windows.exe 86 PID 4168 wrote to memory of 4080 4168 Decent_Sampler-1.8.12.0-Windows.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp"C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp" /SL5="$F00FA,32361468,831488,C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"2⤵
- Executes dropped EXE
PID:4080
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5bbd72aa568e9f2c3e67f5c6db24e9d3e
SHA15a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3
SHA256ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e
SHA512f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741