Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    188s
  • max time network
    260s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/11/2023, 04:50

General

  • Target

    87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe

  • Size

    268KB

  • MD5

    f2e436ae20f182467c21935ab2dc3a9c

  • SHA1

    9bdc93885b2160c947d47425ff185ca686c94474

  • SHA256

    87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a

  • SHA512

    d02bb1d3b3c7ebf0fa0ee6217985762cc6f5c1781f011b94945b4fba1afc937d7f88f7ae9be1cdae4411085e6476eee2f3eeba5a89b333b98f3d317ddb4ae5cc

  • SSDEEP

    3072:CRcFjF23Cf63BMP1BRIG/OnuUHigj5ZBfThXhXXQjAAEV3yn2KFgqgEBIObRQ6cZ:wcFjwju1BRIG/OpRXgjqALgqBvA

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe
    "C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe"
    1⤵
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe
      C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe None
      2⤵
        PID:3348

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

      Filesize

      717B

      MD5

      60fe01df86be2e5331b0cdbe86165686

      SHA1

      2a79f9713c3f192862ff80508062e64e8e0b29bd

      SHA256

      c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

      SHA512

      ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7244112A23658996B30F276F5B84FA23

      Filesize

      503B

      MD5

      290c7a5f423b2f789dc7d50475fe75a4

      SHA1

      ec77f5f9fe41847e6181e9fcca5dd772fe238f0f

      SHA256

      cdb4b50934527022b1fc4277f1f2001fca6c5e55b4ef50b4a02bdb93f5a9434d

      SHA512

      ada7061471ae69649a70260a950d85806f3baa6415797af89a89063d577ff19cd2f6e7d9cb44f721b47b84da9b8df749c92cdb4ac12ddcb4d54f4b45eae12640

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

      Filesize

      192B

      MD5

      b837f3e2406d2be4259cd7787bbf86fb

      SHA1

      2980740406ad64f6d1c2c69de4bdadbb3720b971

      SHA256

      db728839971218595ae643ecf1fbdd8279a6342f6dc8543bc633b5bb85cd646b

      SHA512

      afd04b4fbe1cc80a0ed2a298dd5e7385c7af305cc510dc34f0dade266de4ac114f62d3b252f2d3729a8ea43d1e16d814b8287e61837be265eb1cf275788c3890

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7244112A23658996B30F276F5B84FA23

      Filesize

      548B

      MD5

      77ed805fb3e4ad79fd8c296e2aa1e8ce

      SHA1

      a74512f46fa45869bd4c48710504c8741c7cba02

      SHA256

      d97d07581817ae6e14d63ed3c7f0f5091b0bacb33849ded01488ab723b677586

      SHA512

      652b682dbf8b364500548a0e9b4fb4991426a92f7e94501a7bdaf1b11a5733447da5df2bab06da18631d8e75c385a9d5debb59ea40820fc5acb1ade8b346071f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\SRH13RB4.cookie

      Filesize

      833B

      MD5

      24d47a02d08662c582b4c3a27935346d

      SHA1

      510e27588c2b0c33c6d1213ef798591c8a8e6289

      SHA256

      8f6551fdcd4cf23c4daf3a88ce55c87d315cc5169d053fcb317fbe9a80090182

      SHA512

      76a741959e12e1231a249180336a91ed46559ac1e4d5b4654d1ab851a89ab638f3e34000c8d412a4ae1a1c14f1ab9c5dfef255c41ce06b67922c21270bb7c9be

    • memory/3348-21-0x0000000003CC0000-0x0000000003CDD000-memory.dmp

      Filesize

      116KB

    • memory/3348-22-0x0000000003A80000-0x0000000003B0D000-memory.dmp

      Filesize

      564KB

    • memory/3348-23-0x0000000003CC0000-0x0000000003CDD000-memory.dmp

      Filesize

      116KB

    • memory/3348-24-0x0000000003A80000-0x0000000003B0D000-memory.dmp

      Filesize

      564KB

    • memory/4884-10-0x0000000003FE0000-0x0000000003FFD000-memory.dmp

      Filesize

      116KB

    • memory/4884-11-0x0000000003FE0000-0x0000000003FFD000-memory.dmp

      Filesize

      116KB