Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
131s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
29/10/2023, 12:22
Behavioral task
behavioral1
Sample
f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe
Resource
win10-20231020-en
General
-
Target
f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe
-
Size
266KB
-
MD5
6d594faa8688d04bddbb7c1d80fdac8d
-
SHA1
9fb9c54afa0b7e6241ac2f41768bc27730f172d1
-
SHA256
f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50
-
SHA512
e27dd50828df282a1ed97234dc4781b6c6e2d025bc0c4c21eaee304f0f8dff7884b935e1a71c13936743518452ecc395945721a98dba251494a9d3c82bd92386
-
SSDEEP
6144:CXzKdNY49u8rVtRIasHHN4oqXGj01net:Ra4AuHsHt4jK01
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4852 ITS SB App Switch.exe 1524 ITS SB App Switch.exe -
resource yara_rule behavioral1/memory/3692-0-0x0000000000A70000-0x0000000000B10000-memory.dmp upx behavioral1/memory/3692-8-0x0000000000A70000-0x0000000000B10000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3692 wrote to memory of 4852 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 71 PID 3692 wrote to memory of 4852 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 71 PID 3692 wrote to memory of 4852 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 71 PID 3692 wrote to memory of 1524 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 72 PID 3692 wrote to memory of 1524 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 72 PID 3692 wrote to memory of 1524 3692 f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe"C:\Users\Admin\AppData\Local\Temp\f0aa2cd47656f2ab69f8da0a1063d49497ee85bc747af60c7e2d01c50bec4f50.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"2⤵
- Executes dropped EXE
PID:4852
-
-
C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"2⤵
- Executes dropped EXE
PID:1524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5368332fca74f48697d842c5f4698ae1d
SHA10275153a1e62bd0eca0b02168895517ed66aac56
SHA2563a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59
SHA512fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5
-
Filesize
87KB
MD5368332fca74f48697d842c5f4698ae1d
SHA10275153a1e62bd0eca0b02168895517ed66aac56
SHA2563a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59
SHA512fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5
-
Filesize
87KB
MD5368332fca74f48697d842c5f4698ae1d
SHA10275153a1e62bd0eca0b02168895517ed66aac56
SHA2563a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59
SHA512fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5