Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2023, 19:36

General

  • Target

    b69e3751640815ad9d3ffa99dd71382b_JC.exe

  • Size

    93KB

  • MD5

    b69e3751640815ad9d3ffa99dd71382b

  • SHA1

    8c5dc5d06a42a10120802569855e5b746a854b44

  • SHA256

    b267376cb4bf8e864c45705168deb53e1801e742b8becf6664b01b51ef624893

  • SHA512

    4c510d65155eb95765216d3b22201cf5323dc1d97635281314c6cd32e006915b83fb96229718766fd1940d0df035930af56492737eb353688c37f648515a933f

  • SSDEEP

    1536:tF0AJELoJHG9qa+oa33KJJzAKWYr0v7iJSzIRXKTzRZICrWaGZh75:tiAyLN9qa+oEGrWViJSzIR6JJrWNZr

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b69e3751640815ad9d3ffa99dd71382b_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\b69e3751640815ad9d3ffa99dd71382b_JC.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\ProgramData\Update\WwanSvc.exe
      "C:\ProgramData\Update\WwanSvc.exe" /run
      2⤵
      • Executes dropped EXE
      PID:1088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Update\WwanSvc.exe

    Filesize

    93KB

    MD5

    4705be3f1e1932db1470ef4954f90a4c

    SHA1

    784d5d6a2dcb37e2d2240df31bd6ead19d528e92

    SHA256

    405203e48bd0cfbead3c7034c3ecb9f74f27dc43fd875e55872436372fe3381c

    SHA512

    8722ff55c91221d5fd8e2dbe97f5b8156bfa61c5fb480f8ac72238695db59c20cd3d158256c8462e30964f3ae42193958f35d46caba156c1e79ee76980c79b44

  • C:\ProgramData\Update\WwanSvc.exe

    Filesize

    93KB

    MD5

    4705be3f1e1932db1470ef4954f90a4c

    SHA1

    784d5d6a2dcb37e2d2240df31bd6ead19d528e92

    SHA256

    405203e48bd0cfbead3c7034c3ecb9f74f27dc43fd875e55872436372fe3381c

    SHA512

    8722ff55c91221d5fd8e2dbe97f5b8156bfa61c5fb480f8ac72238695db59c20cd3d158256c8462e30964f3ae42193958f35d46caba156c1e79ee76980c79b44