Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 01:41

General

  • Target

    3affd056e18139b66a16230838ded800exe_JC.exe

  • Size

    596KB

  • MD5

    3affd056e18139b66a16230838ded800

  • SHA1

    4f5f33bfbc11ed209d1aa4ae6d0232076b4025ff

  • SHA256

    ff64314d0776d185e1165dc69e30cd7005f258c2d0b84f564b0ff647010d6387

  • SHA512

    e82e0857adc2aa25e511b712fcd4579bd3ecd0b7bab5cafcf0432767a93c82da1fac08542e1c004be6fa229c6f662eab9993e37a63f428f436314ad1f15a5b9b

  • SSDEEP

    1536:OKD0A2T3vLbsih9e8bTTpb/IgQmP9zKcTDB4w/UjlQ/dpKRq:352T3siXei5bcmP9JfUjW

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3affd056e18139b66a16230838ded800exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\3affd056e18139b66a16230838ded800exe_JC.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4500
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c c:\$$$$$.bat
      2⤵
        PID:916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\drivers32\Tomb Raider - The Angel of Darkness No-Cd Crack.exe

      Filesize

      596KB

      MD5

      3affd056e18139b66a16230838ded800

      SHA1

      4f5f33bfbc11ed209d1aa4ae6d0232076b4025ff

      SHA256

      ff64314d0776d185e1165dc69e30cd7005f258c2d0b84f564b0ff647010d6387

      SHA512

      e82e0857adc2aa25e511b712fcd4579bd3ecd0b7bab5cafcf0432767a93c82da1fac08542e1c004be6fa229c6f662eab9993e37a63f428f436314ad1f15a5b9b

    • \??\c:\$$$$$.bat

      Filesize

      212B

      MD5

      f70dc6ea794615683d871f39d871bd8d

      SHA1

      7c94c6364950842a83d8f78fd3191597d45e1527

      SHA256

      3a2b052118ad411adf53797710112dceb31202b2eacb1b929d552e1df4174ca5

      SHA512

      e494285ef214b4da75ec02d245b6b36a4eb884978fd5d36776afc60d6f11ad9e622dbfc2f1631790c10fc031da97fc3fe2f46d2ed2fabc7f966f3d8d2c71c10c

    • memory/4500-0-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4500-487-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB

    • memory/4500-821-0x0000000000400000-0x000000000043F000-memory.dmp

      Filesize

      252KB