Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2023, 01:24

General

  • Target

    1db75d558351403bbb3359c154a0ed83.exe

  • Size

    262.4MB

  • MD5

    1db75d558351403bbb3359c154a0ed83

  • SHA1

    1e4a84dcda1f481d93d467d31660cae8baeb2416

  • SHA256

    cc8e8b89706cff92887a171672f98cd7c403830a401c08c61763182db79c492f

  • SHA512

    1ebdfb09fcea43f8d11615bfec82d43a881739876e2edb03560fddf46c435e2127d211c32d25dbebb87af96dbd1ef686eb29f5390edeb909268b740883f7191a

  • SSDEEP

    6291456:k2PX/RWrd42KagyvvpjlzrR35gdU7e89AubOizpvyb6Bfhc3+:kwsrd4vagwpRV5gd4KizFyeBfW

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1db75d558351403bbb3359c154a0ed83.exe
    "C:\Users\Admin\AppData\Local\Temp\1db75d558351403bbb3359c154a0ed83.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Users\Admin\AppData\Local\Temp\is-N297L.tmp\1db75d558351403bbb3359c154a0ed83.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-N297L.tmp\1db75d558351403bbb3359c154a0ed83.tmp" /SL5="$C0028,274388154,278528,C:\Users\Admin\AppData\Local\Temp\1db75d558351403bbb3359c154a0ed83.exe"
      2⤵
      • Executes dropped EXE
      PID:1016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-N297L.tmp\1db75d558351403bbb3359c154a0ed83.tmp

    Filesize

    1.3MB

    MD5

    b7f87ca2b74475400e612ef44abc4f25

    SHA1

    709787d5027456e621337141d4b6cf7ce763a551

    SHA256

    68d8cd852738342c2d3963b3ceafd89f142edac3842b6159fd0ca37eb962b095

    SHA512

    df580392f346aad03ac4b7f5e56ddd732a349f80dc9114f7322182892138d7d7563ea5862108f404eaee74c51aae5d23be9d67ba2f5e32b749e0351bfddf9495

  • memory/1016-6-0x0000000000830000-0x0000000000831000-memory.dmp

    Filesize

    4KB

  • memory/1016-9-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/1016-10-0x0000000000830000-0x0000000000831000-memory.dmp

    Filesize

    4KB

  • memory/2396-1-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2396-7-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB