Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 05:26

General

  • Target

    ec22b0f93bf2e35f9c2ed338d59fed68.exe

  • Size

    2.2MB

  • MD5

    ec22b0f93bf2e35f9c2ed338d59fed68

  • SHA1

    a381b0fa8727c7fc723638546b7378850beeb8d1

  • SHA256

    fc73b102e40787082518533d6c871d300ce4c4bcb83700e0c21b5e4fc6098203

  • SHA512

    27d6b7cd371d455213b8baaae38820a3705b848238954949dd9bb8233504d4c576238f612c13c20d4c29afd369c4237a7041b89b9bc33bba5073d1ebe42db382

  • SSDEEP

    49152:ufuyo2d519Lb2sLqcFVbnQtcYAue8AK+qs/62N9JkmN:h3m19Lb2oe29JF

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec22b0f93bf2e35f9c2ed338d59fed68.exe
    "C:\Users\Admin\AppData\Local\Temp\ec22b0f93bf2e35f9c2ed338d59fed68.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3472
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c .\4FJTR.cMD
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\SysWOW64\control.exe
        CONtROL "C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\JG.o"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3544
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\JG.o"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:5004
          • C:\Windows\system32\RunDll32.exe
            C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\JG.o"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2552
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\JG.o"
              6⤵
              • Loads dropped DLL
              PID:1460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\4fJTr.cmd

    Filesize

    27B

    MD5

    e128cac46496e91dc85f16c10dbbf8a4

    SHA1

    727c24ff1e81d577652251091a94da35040d65bc

    SHA256

    0c3abdbda7527b7a256670828d0b6abc7c93cc1ce6d18209007f4d0542c31a99

    SHA512

    3ed32e76f5ec9735e786639e992e2dcbd9b15dbf6d02d865e4071f88ed706406f714d6f8a85e2dc4a3194a799120eafda205d6c6975df3448dae9fcf77e2ad8b

  • C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\JG.o

    Filesize

    2.4MB

    MD5

    0255f1f5ddcd8b99f93dfae4980cc9f2

    SHA1

    f948966990414fa49230631ad612a30d70ee2f22

    SHA256

    618a2c28de7593e6e9e17affd34ff2b05fe7b3c00740343c81f554f65cdefbc8

    SHA512

    8092eea9415b047f40e9517f13fb52668f5813fe566f9d993227c957f1fcaf1e59f535e34e5c626d4294e74050d99f581c0f11c734a26c484118cae3f98d9b23

  • C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\JG.o

    Filesize

    2.4MB

    MD5

    0255f1f5ddcd8b99f93dfae4980cc9f2

    SHA1

    f948966990414fa49230631ad612a30d70ee2f22

    SHA256

    618a2c28de7593e6e9e17affd34ff2b05fe7b3c00740343c81f554f65cdefbc8

    SHA512

    8092eea9415b047f40e9517f13fb52668f5813fe566f9d993227c957f1fcaf1e59f535e34e5c626d4294e74050d99f581c0f11c734a26c484118cae3f98d9b23

  • C:\Users\Admin\AppData\Local\Temp\7zS09D4F4A7\JG.o

    Filesize

    2.4MB

    MD5

    0255f1f5ddcd8b99f93dfae4980cc9f2

    SHA1

    f948966990414fa49230631ad612a30d70ee2f22

    SHA256

    618a2c28de7593e6e9e17affd34ff2b05fe7b3c00740343c81f554f65cdefbc8

    SHA512

    8092eea9415b047f40e9517f13fb52668f5813fe566f9d993227c957f1fcaf1e59f535e34e5c626d4294e74050d99f581c0f11c734a26c484118cae3f98d9b23

  • memory/1460-28-0x00000000032D0000-0x00000000033CC000-memory.dmp

    Filesize

    1008KB

  • memory/1460-27-0x00000000032D0000-0x00000000033CC000-memory.dmp

    Filesize

    1008KB

  • memory/1460-24-0x00000000032D0000-0x00000000033CC000-memory.dmp

    Filesize

    1008KB

  • memory/1460-23-0x00000000031B0000-0x00000000032C9000-memory.dmp

    Filesize

    1.1MB

  • memory/1460-19-0x00000000029B0000-0x00000000029B6000-memory.dmp

    Filesize

    24KB

  • memory/5004-9-0x0000000010000000-0x0000000010271000-memory.dmp

    Filesize

    2.4MB

  • memory/5004-17-0x0000000003570000-0x000000000366C000-memory.dmp

    Filesize

    1008KB

  • memory/5004-16-0x0000000003570000-0x000000000366C000-memory.dmp

    Filesize

    1008KB

  • memory/5004-13-0x0000000003570000-0x000000000366C000-memory.dmp

    Filesize

    1008KB

  • memory/5004-12-0x0000000010000000-0x0000000010271000-memory.dmp

    Filesize

    2.4MB

  • memory/5004-11-0x0000000003450000-0x0000000003569000-memory.dmp

    Filesize

    1.1MB

  • memory/5004-8-0x0000000002D40000-0x0000000002D46000-memory.dmp

    Filesize

    24KB