Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    105s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2023, 19:35

General

  • Target

    355e00183b3aea992959bd32db884770_exe32_JC.exe

  • Size

    1.1MB

  • MD5

    355e00183b3aea992959bd32db884770

  • SHA1

    647e16720e9a409943899add01c7b2c955821618

  • SHA256

    5b1450cff61be58dc14b63f1c3e26ed33cbc8a387c603c5be34e38f3d4275c02

  • SHA512

    76cbd64e6f8d6f3ebe3ca65ef37a1f7fd66f0e13b55c90457fbf5e877dab98a939a865e51dc7b77cac1a97f33c3b3501b03794c133cdb6e0a137466a26db69d9

  • SSDEEP

    24576:8BJhlR9YTMJjG2oE8xk2ZFquG6OPWCcCBfAKyv9hGYkNruNBWS95:8BJJPJjG2onxk2/zG6rCtM9Q/gBZX

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\355e00183b3aea992959bd32db884770_exe32_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\355e00183b3aea992959bd32db884770_exe32_JC.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe
      "C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe"
      2⤵
      • Executes dropped EXE
      PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe

    Filesize

    1.1MB

    MD5

    02e1655a8e0f53399389447818dd83d2

    SHA1

    9f3a8015f1079a4e3d6dafc7747954269e8415ea

    SHA256

    9fb2eebfc22c22d30e95541c27aa1264c8d5212eebadf0ec79e6c8af015c445f

    SHA512

    5f0b8e3f0ca385badc60d08eefe806d173d6c30ecc5e37eac8880b090d9e454b1de6f19599f17390c93b03908637487b4129bca0b6f5faf559d2f47d6fc8a3b7

  • C:\Program Files (x86)\rddhzkpw\qjsgdnykf.exe

    Filesize

    1.1MB

    MD5

    02e1655a8e0f53399389447818dd83d2

    SHA1

    9f3a8015f1079a4e3d6dafc7747954269e8415ea

    SHA256

    9fb2eebfc22c22d30e95541c27aa1264c8d5212eebadf0ec79e6c8af015c445f

    SHA512

    5f0b8e3f0ca385badc60d08eefe806d173d6c30ecc5e37eac8880b090d9e454b1de6f19599f17390c93b03908637487b4129bca0b6f5faf559d2f47d6fc8a3b7

  • memory/2228-0-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2228-1-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2228-6-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2280-7-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB

  • memory/2280-8-0x0000000000400000-0x000000000048E000-memory.dmp

    Filesize

    568KB