Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2023, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe
Resource
win10v2004-20230915-en
General
-
Target
SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe
-
Size
2.2MB
-
MD5
5bacad997fee21b16c7265d27f8cf2f7
-
SHA1
4c16385554f31b237336e0ec27674127ba9dd735
-
SHA256
b653a89e2a50d9f48353c875198d7f64344d227accdc5c8bd35823502800842b
-
SHA512
f0c4ee6777092526de94c92c120ab0b21eed6f6e8fc49e5359178ee3a4a96b7eb2d0689f87f39c26fad6b9cd6a86da43c33ef2de7f8b3e26fb15e7bcf02d4376
-
SSDEEP
49152:ufC4M200n9b3Dd0iefUpYpYsEWFSrV5N7mAui+wSnpgrEIr:jxk350HfUOhEWFSr7xu4SpdIr
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2408 rundll32.exe 2144 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3712 wrote to memory of 3012 3712 SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe 85 PID 3712 wrote to memory of 3012 3712 SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe 85 PID 3712 wrote to memory of 3012 3712 SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe 85 PID 3012 wrote to memory of 3404 3012 cmd.exe 87 PID 3012 wrote to memory of 3404 3012 cmd.exe 87 PID 3012 wrote to memory of 3404 3012 cmd.exe 87 PID 3404 wrote to memory of 2408 3404 control.exe 90 PID 3404 wrote to memory of 2408 3404 control.exe 90 PID 3404 wrote to memory of 2408 3404 control.exe 90 PID 2408 wrote to memory of 2180 2408 rundll32.exe 96 PID 2408 wrote to memory of 2180 2408 rundll32.exe 96 PID 2180 wrote to memory of 2144 2180 RunDll32.exe 97 PID 2180 wrote to memory of 2144 2180 RunDll32.exe 97 PID 2180 wrote to memory of 2144 2180 RunDll32.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.29934.27343.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c .\SDUUEurC.baT2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\control.execONtrol "C:\Users\Admin\AppData\Local\Temp\7zS08E30B77\QEGMnP.lV"3⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS08E30B77\QEGMnP.lV"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS08E30B77\QEGMnP.lV"5⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS08E30B77\QEGMnP.lV"6⤵
- Loads dropped DLL
PID:2144
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD55780caa07db841a6055da9b4b4ba83ec
SHA13934ef9e39fbbfbf5b1c68df8ed82b4af56e16be
SHA2560e5646fb7f743fd7f90b67686d45bb8c4bde3fab5cf6d80dd839d061abdcfa24
SHA5126feea9f5177286176429126f0b427ad11ab134f5b593e93bac808c79add3da77ac998975b602b85d0d68012a9e4df23d07aec093dca67dd614f47a5eda2881d8
-
Filesize
2.3MB
MD55780caa07db841a6055da9b4b4ba83ec
SHA13934ef9e39fbbfbf5b1c68df8ed82b4af56e16be
SHA2560e5646fb7f743fd7f90b67686d45bb8c4bde3fab5cf6d80dd839d061abdcfa24
SHA5126feea9f5177286176429126f0b427ad11ab134f5b593e93bac808c79add3da77ac998975b602b85d0d68012a9e4df23d07aec093dca67dd614f47a5eda2881d8
-
Filesize
2.3MB
MD55780caa07db841a6055da9b4b4ba83ec
SHA13934ef9e39fbbfbf5b1c68df8ed82b4af56e16be
SHA2560e5646fb7f743fd7f90b67686d45bb8c4bde3fab5cf6d80dd839d061abdcfa24
SHA5126feea9f5177286176429126f0b427ad11ab134f5b593e93bac808c79add3da77ac998975b602b85d0d68012a9e4df23d07aec093dca67dd614f47a5eda2881d8
-
Filesize
31B
MD525dc217ac54b00e2e53649ec0676183a
SHA16b6c7bfc2efe57fe0776aa66751588aa2e20788c
SHA256105a7495ceafadd78cf766ac2423faf32a180194bf51466d1187387b29646db7
SHA512e8b3ad77580eed5856caa0ecdd4eb683f6896bdecb7cec1d59f97a8c19aac9a13b458a98e3a8b014c28d59ec644ab53af6789c5cce0e5a82d182872c3559d68e