Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
20/09/2023, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe
Resource
win10-20230915-en
General
-
Target
eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe
-
Size
1.8MB
-
MD5
1e678c57bf3f6ba695b0a68a16211b33
-
SHA1
03e41e6d97b40eccf237d3b01108b0b44fcd85ce
-
SHA256
eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873
-
SHA512
91fef12d5b016c315cb0e2df8cb52609959415ef41d2bba097a22b36424ad63e0cd0bad96489e20ab1718f1836a8f508f4c102bfaea1762e26d65df66f81c135
-
SSDEEP
49152:HdgfeYRUHTBeIGGoSntswWSSG+9UFibEBs/F6:HmPRSTBcSllSG8UFibWs/U
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1300 regsvr32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2000 wrote to memory of 1300 2000 eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe 70 PID 2000 wrote to memory of 1300 2000 eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe 70 PID 2000 wrote to memory of 1300 2000 eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe"C:\Users\Admin\AppData\Local\Temp\eb7e63f57992fb633ff1e409e637447ee1560fb21532a176e0ba30a4539fb873.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -S O2dyJ.d2⤵
- Loads dropped DLL
PID:1300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5068c04dbeb88b9eadd0a40fc3c0c1764
SHA165e2ca692631bba69c6c6fc652eefc29d47e44ed
SHA256062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8
SHA5121843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb
-
Filesize
1.4MB
MD5068c04dbeb88b9eadd0a40fc3c0c1764
SHA165e2ca692631bba69c6c6fc652eefc29d47e44ed
SHA256062fee35375b42773b67eaf50dd631d682a278835f1e4cf7b0e533921e8df8d8
SHA5121843a5c859f56ce3dcb74870d2be1164029e469359f19032739d5367dc1019dec6a4005fe514b288247e13ccf47f01d0bffc11bf22adffe30e94861968ffbcbb