Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    27s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 21:50

General

  • Target

    77574083a73bf4abe850f98c7cf758a8_JC.exe

  • Size

    714KB

  • MD5

    77574083a73bf4abe850f98c7cf758a8

  • SHA1

    69c245b5d48f16d63e90f8db771d11ac68984dc2

  • SHA256

    9fcd6c43848454f32c61c3e2c86df019c71f6664fd19ce2e0e992e68cacf7b49

  • SHA512

    40aabc9f55f5d2e9c1125364fbb66129c06c29e64f98aa7aa0b1ac42c5aeb7ca4a82f9c780e1864cc0365f3dd841137f27499c3d2d6fc187ca5d2023a680fedc

  • SSDEEP

    12288:phJ6nTOYREU1gL5pRTcAkS/3hzN8qE43fm78V5:phJ6nTOYKx5jcAkSYqyE5

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2692
    • C:\WINDOWS\MSWDM.EXE
      "C:\WINDOWS\MSWDM.EXE"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4696
    • C:\WINDOWS\MSWDM.EXE
      -r!C:\Windows\dev6C18.tmp!C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe! !
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5028
      • C:\Users\Admin\AppData\Local\Temp\77574083A73BF4ABE850F98C7CF758A8_JC.EXE
        3⤵
        • Executes dropped EXE
        PID:3952
      • C:\WINDOWS\MSWDM.EXE
        -e!C:\Windows\dev6C18.tmp!C:\Users\Admin\AppData\Local\Temp\77574083A73BF4ABE850F98C7CF758A8_JC.EXE!
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        PID:3288

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\77574083A73BF4ABE850F98C7CF758A8_JC.EXE

    Filesize

    714KB

    MD5

    1d25aa70c057827a6e6965c420dd1c4c

    SHA1

    87f177cc00ec4a9ae40bcfc145e854f23d39b682

    SHA256

    8765fba8d862dec093cf1bd223c949534b46cf15eb877397ba3c9197e50438c9

    SHA512

    a7cb92a6360804b7a2c039901d92b70f6f1fb6d2f34ef1b10b2b88922043286770f8283e7753ff6e0b7c2e2169b23c94cc71eba36e237cf3ba6ac78fe482ee3d

  • C:\Users\Admin\AppData\Local\Temp\77574083A73BF4ABE850F98C7CF758A8_JC.EXE

    Filesize

    714KB

    MD5

    1d25aa70c057827a6e6965c420dd1c4c

    SHA1

    87f177cc00ec4a9ae40bcfc145e854f23d39b682

    SHA256

    8765fba8d862dec093cf1bd223c949534b46cf15eb877397ba3c9197e50438c9

    SHA512

    a7cb92a6360804b7a2c039901d92b70f6f1fb6d2f34ef1b10b2b88922043286770f8283e7753ff6e0b7c2e2169b23c94cc71eba36e237cf3ba6ac78fe482ee3d

  • C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe

    Filesize

    458KB

    MD5

    619f7135621b50fd1900ff24aade1524

    SHA1

    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

    SHA256

    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

    SHA512

    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

  • C:\Users\Admin\AppData\Local\Temp\77574083a73bf4abe850f98c7cf758a8_JC.exe

    Filesize

    714KB

    MD5

    1d25aa70c057827a6e6965c420dd1c4c

    SHA1

    87f177cc00ec4a9ae40bcfc145e854f23d39b682

    SHA256

    8765fba8d862dec093cf1bd223c949534b46cf15eb877397ba3c9197e50438c9

    SHA512

    a7cb92a6360804b7a2c039901d92b70f6f1fb6d2f34ef1b10b2b88922043286770f8283e7753ff6e0b7c2e2169b23c94cc71eba36e237cf3ba6ac78fe482ee3d

  • C:\WINDOWS\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\MSWDM.EXE

    Filesize

    256KB

    MD5

    8a1198209520897514a2d82a912a66d2

    SHA1

    5dda8ec47f948814d808cd71e89ebe65940a1ff7

    SHA256

    5ce9e416f5b7811b9e91ec2de680aad0c38aa4a080999853b096b06d409887f0

    SHA512

    9a6e4e3729f77bcdcc1ace7fa154490717473fb05899e13b1f920ee438dc1c1812eae6fdec8b97da7807e9d626014ad0481d9cf0d4f5a06e327b4b75534f7e00

  • C:\Windows\dev6C18.tmp

    Filesize

    458KB

    MD5

    619f7135621b50fd1900ff24aade1524

    SHA1

    6c7ea8bbd435163ae3945cbef30ef6b9872a4591

    SHA256

    344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

    SHA512

    2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628