Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 03:00

General

  • Target

    7441fe25afda1adfd618fb3d603f0fdbbab3ec4ab47a51252dc2030cebf52e3f.exe

  • Size

    925KB

  • MD5

    666f6d4e736ddfed99c93ef08ec2f313

  • SHA1

    e3d120cc7e4557afce230c9cd56a13a43baf2bf9

  • SHA256

    7441fe25afda1adfd618fb3d603f0fdbbab3ec4ab47a51252dc2030cebf52e3f

  • SHA512

    7db2ba9690be13a09f45e12fba27f8589b2fcc39c0b8abf3cc6ae83d6af21d6b5bdcffef63eb37bc2c1626fcf682481d67aaec2e08eebf439b8ea480b6d7e788

  • SSDEEP

    24576:hPpeZJniROWKdTysB//EXK2ufvNTSLsDW4z:tMZJDdT/BXEXK2ufvNTSLsy4

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7441fe25afda1adfd618fb3d603f0fdbbab3ec4ab47a51252dc2030cebf52e3f.exe
    "C:\Users\Admin\AppData\Local\Temp\7441fe25afda1adfd618fb3d603f0fdbbab3ec4ab47a51252dc2030cebf52e3f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4136
    • C:\Users\Admin\AppData\Local\Temp\2023-10-16-1608.exe
      "C:\Users\Admin\AppData\Local\Temp\2023-10-16-1608.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2023-10-16-1608.exe

    Filesize

    985KB

    MD5

    498f0ae33234a1f22f4ec60719ed1aa6

    SHA1

    28f904fd80673ccb175b493fba3c71eb9a8d9c6a

    SHA256

    0a001f7d59b2122db8b58edb821159cae09d18a9a0370aeb1c12858284337c6e

    SHA512

    d82d011b16e02c85300118ec8ea52326e848e759b1e17cb918e0caab7cf4adf11def350fa3a882f5c43e08e0d1172dc021cc722f8a94600f0996aad3c54b6398

  • C:\Users\Admin\AppData\Local\Temp\2023-10-16-1608.exe

    Filesize

    985KB

    MD5

    498f0ae33234a1f22f4ec60719ed1aa6

    SHA1

    28f904fd80673ccb175b493fba3c71eb9a8d9c6a

    SHA256

    0a001f7d59b2122db8b58edb821159cae09d18a9a0370aeb1c12858284337c6e

    SHA512

    d82d011b16e02c85300118ec8ea52326e848e759b1e17cb918e0caab7cf4adf11def350fa3a882f5c43e08e0d1172dc021cc722f8a94600f0996aad3c54b6398

  • memory/1376-8-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

    Filesize

    2.0MB

  • memory/1376-5-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

    Filesize

    2.0MB

  • memory/1376-7-0x000002584A4E0000-0x000002584A4E1000-memory.dmp

    Filesize

    4KB

  • memory/1376-6-0x000002584A4D0000-0x000002584A4D1000-memory.dmp

    Filesize

    4KB

  • memory/1376-4-0x00007FF74D430000-0x00007FF74D52C000-memory.dmp

    Filesize

    1008KB

  • memory/1376-9-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

    Filesize

    2.0MB

  • memory/1376-10-0x00007FF74D430000-0x00007FF74D52C000-memory.dmp

    Filesize

    1008KB

  • memory/1376-12-0x000002584A4D0000-0x000002584A4D1000-memory.dmp

    Filesize

    4KB

  • memory/1376-11-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

    Filesize

    2.0MB

  • memory/1376-14-0x000002584A4E0000-0x000002584A4E1000-memory.dmp

    Filesize

    4KB

  • memory/1376-13-0x000002584A4D0000-0x000002584A4D1000-memory.dmp

    Filesize

    4KB

  • memory/1376-15-0x00007FFA92790000-0x00007FFA92985000-memory.dmp

    Filesize

    2.0MB