Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2023, 20:01

General

  • Target

    Decent_Sampler-1.8.12.0-Windows.exe

  • Size

    31.7MB

  • MD5

    1fb5e8893336b758740944ea0f2965a8

  • SHA1

    8a849d422806fac01693ef44402bdf9ec14d34ba

  • SHA256

    8ffc45ed98a4e16a0e2e58eb9e35f6f73a3a7520adb2e7e9360d7acead3a5f8c

  • SHA512

    61acb91b0eaeb452604bcddf3004c37aafdd01d89b9532b40a4471a975414c3531eff9ae43243b1ccc418b64e59c5ae8d4bcebb6a7a0cd9874a7274d6537b44d

  • SSDEEP

    786432:t+CMjkyOX0+Q/JQViulnYrsDDc4u3Mwh1+G1opCMi2KH:5GLGkWViu6I3Fw04oQMi

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp" /SL5="$F00FA,32361468,831488,C:\Users\Admin\AppData\Local\Temp\Decent_Sampler-1.8.12.0-Windows.exe"
      2⤵
      • Executes dropped EXE
      PID:4080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-440OE.tmp\Decent_Sampler-1.8.12.0-Windows.tmp

    Filesize

    3.0MB

    MD5

    bbd72aa568e9f2c3e67f5c6db24e9d3e

    SHA1

    5a6bbbcfaac32e7ad3d25d77f65efd3794cc83d3

    SHA256

    ee8b8339f58e9ac39efe9b27c29bf9b5a6f09028f231c2f5f7e671760ee8622e

    SHA512

    f94abb0e5bb0829472db638b5ec846e5580ec792fe0f21be6ea2745aa2c87b7a1782111dafb5350b2089bf672fcdfd08059d750ce87f2448761c95c983e14741

  • memory/4080-139-0x0000000000A30000-0x0000000000A31000-memory.dmp

    Filesize

    4KB

  • memory/4080-142-0x0000000000400000-0x000000000071A000-memory.dmp

    Filesize

    3.1MB

  • memory/4080-143-0x0000000000A30000-0x0000000000A31000-memory.dmp

    Filesize

    4KB

  • memory/4168-134-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

  • memory/4168-141-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB