Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 01:24
Static task
static1
Behavioral task
behavioral1
Sample
1db75d558351403bbb3359c154a0ed83.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1db75d558351403bbb3359c154a0ed83.exe
Resource
win10v2004-20231023-en
General
-
Target
1db75d558351403bbb3359c154a0ed83.exe
-
Size
262.4MB
-
MD5
1db75d558351403bbb3359c154a0ed83
-
SHA1
1e4a84dcda1f481d93d467d31660cae8baeb2416
-
SHA256
cc8e8b89706cff92887a171672f98cd7c403830a401c08c61763182db79c492f
-
SHA512
1ebdfb09fcea43f8d11615bfec82d43a881739876e2edb03560fddf46c435e2127d211c32d25dbebb87af96dbd1ef686eb29f5390edeb909268b740883f7191a
-
SSDEEP
6291456:k2PX/RWrd42KagyvvpjlzrR35gdU7e89AubOizpvyb6Bfhc3+:kwsrd4vagwpRV5gd4KizFyeBfW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1016 1db75d558351403bbb3359c154a0ed83.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2396 wrote to memory of 1016 2396 1db75d558351403bbb3359c154a0ed83.exe 91 PID 2396 wrote to memory of 1016 2396 1db75d558351403bbb3359c154a0ed83.exe 91 PID 2396 wrote to memory of 1016 2396 1db75d558351403bbb3359c154a0ed83.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\1db75d558351403bbb3359c154a0ed83.exe"C:\Users\Admin\AppData\Local\Temp\1db75d558351403bbb3359c154a0ed83.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\is-N297L.tmp\1db75d558351403bbb3359c154a0ed83.tmp"C:\Users\Admin\AppData\Local\Temp\is-N297L.tmp\1db75d558351403bbb3359c154a0ed83.tmp" /SL5="$C0028,274388154,278528,C:\Users\Admin\AppData\Local\Temp\1db75d558351403bbb3359c154a0ed83.exe"2⤵
- Executes dropped EXE
PID:1016
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5b7f87ca2b74475400e612ef44abc4f25
SHA1709787d5027456e621337141d4b6cf7ce763a551
SHA25668d8cd852738342c2d3963b3ceafd89f142edac3842b6159fd0ca37eb962b095
SHA512df580392f346aad03ac4b7f5e56ddd732a349f80dc9114f7322182892138d7d7563ea5862108f404eaee74c51aae5d23be9d67ba2f5e32b749e0351bfddf9495