Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 16:35

General

  • Target

    0952a9f883147012ec31e69370dd4590_exe32_JC.exe

  • Size

    736KB

  • MD5

    0952a9f883147012ec31e69370dd4590

  • SHA1

    1364fb010aee9d1463693c9a3df72e29500b6456

  • SHA256

    e75357a102d8d32b9071917071f0503310d3b84a5ea7634b45927d7b511cff1f

  • SHA512

    f94d5d94970e520f88eb5b3167780eef962b8e6d7f5d857fd601a40f1a833970eda482b2756ca9f6ab20d4adde3ed1f104e2dae27df4d4f57840c316a186b2a0

  • SSDEEP

    12288:P1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D0FoWxJpcEi0/3IWV//7cSdmdIs7fOtN9i:P1/aGLDCM4D8ayGMZo8/qdf7fO3d4

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0952a9f883147012ec31e69370dd4590_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\0952a9f883147012ec31e69370dd4590_exe32_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3288
    • C:\ProgramData\ieicfa.exe
      "C:\ProgramData\ieicfa.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings .exe

    Filesize

    736KB

    MD5

    8207496336d8453f88665d86a00a58da

    SHA1

    ade0764158b26ed4f3013f63dad8faca21f14c24

    SHA256

    fb61f9ea94dbf95c9bc67dec08d7b03013b668d87795a6cacc89ec5510da7e50

    SHA512

    cac60ba4a9339c3700d8ba1664c79d797443a96ea9b8d55e7312e0e283d8dfd1f00c3b7093a0f114651cba157c92731e309335cdd152550ff2855645ca4c13a2

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\Saaaalamm\Mira.h

    Filesize

    477KB

    MD5

    70d6cb7dd01ebd5a21af02945d2ae12f

    SHA1

    05260b3e17a221e66b58d1e5ed1d0f518392159a

    SHA256

    136fb79a4b868976a011043345fbef2cb088dd799757ec3970480eb99d9f2e92

    SHA512

    b2c4c5b6bc5519ebb8e701c37eb298f6bdbb89b09bbf93a4f5c7a0e5b809b7bb3a6355087797e5064c1cc67a1555cbdab782fcba2f8a9d0f18d4f53337a34ea9

  • C:\ProgramData\ieicfa.exe

    Filesize

    258KB

    MD5

    c59b1ebe57c537249e11946ea393673b

    SHA1

    6a8e7ee34355ee58db3b26a04a6e883e41b6e244

    SHA256

    1f9e9f631c94e0251566339f49e72d9a557391768c73baf442c250475beddbe0

    SHA512

    f4ada58b45dfd318d50b9ec6d6c80ec46203d7644b8faf6e32b533421cb29288013932116e1e8c7a37d953c8a459249c1ad8a7cc60c575fd9e9f5a37b7bea4f3

  • C:\ProgramData\ieicfa.exe

    Filesize

    258KB

    MD5

    c59b1ebe57c537249e11946ea393673b

    SHA1

    6a8e7ee34355ee58db3b26a04a6e883e41b6e244

    SHA256

    1f9e9f631c94e0251566339f49e72d9a557391768c73baf442c250475beddbe0

    SHA512

    f4ada58b45dfd318d50b9ec6d6c80ec46203d7644b8faf6e32b533421cb29288013932116e1e8c7a37d953c8a459249c1ad8a7cc60c575fd9e9f5a37b7bea4f3

  • memory/2468-40-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/2468-131-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/2468-523-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/2468-1283-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/3288-7-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB