Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 19:00
Static task
static1
Behavioral task
behavioral1
Sample
614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe
Resource
win10v2004-20231023-en
General
-
Target
614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe
-
Size
15.9MB
-
MD5
dce14c431c804929d49af08280aa0f85
-
SHA1
2f458cd702d014a8ddf88705642c0adfd2d052e4
-
SHA256
614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881
-
SHA512
27cd83e6f6da5185d7e54641fbb5efc9c650dcc70dfb990434e7dd179c778fa9e750ff6a1e2aab7cd4f86210dfb6cff061b1d9ba69b701a1a82964ee0967befb
-
SSDEEP
393216:97QNnRoTh8667Hr+ixTMWqJ9GfDFryns8j4fUcBuVj0zmvEU:97buxbiixTM5OfDF2r0fUIuVj0KEU
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4248 wrote to memory of 2480 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 96 PID 4248 wrote to memory of 2480 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 96 PID 4248 wrote to memory of 2480 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 96 PID 4248 wrote to memory of 2280 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 95 PID 4248 wrote to memory of 2280 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 95 PID 4248 wrote to memory of 2280 4248 614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe"C:\Users\Admin\AppData\Local\Temp\614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"2⤵PID:2280
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exe"2⤵PID:2480
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51b8a0d3a8a14c9303bbad88752cd9a4b
SHA1f0e2810c4553464214f65eada07b9fc344700c1e
SHA256ca9dfceea8763bb6ff803bc54c3d7a57e9a509d6b2c51b16c80bc8f5c3632399
SHA512bff86142ac54462676e4b43c254208c0280fe42630419f36a39ad9f9ed157f1ec3ebf45e691163183638ab5917901d3de9b8d0e30592ec5cf629b2e7d0096171
-
Filesize
1KB
MD52c7fafe0a47f8817fd84db00f877ce57
SHA172e145e7e78c0df68985c55f796ca9048df00de9
SHA256c947238724fcde71ff172731c413fc5e2401ed6088f23d4b7ff2d90b82eb1750
SHA512c01d432f2834fe65f94f4a4a4a1019ed7a8afa19e1b67f6a2796fd9d25887a4dddd6ba94c1327019d80c5b6261788ff6abc2671e5efb7e0c733dee0707077e6d
-
C:\Users\Admin\AppData\Local\Temp\614f8774d08e0ab088026df158908174e805f40832f48bdb84bdd7f4c2ea5881.exepack.tmp
Filesize2KB
MD5cf0924e04ff5d9b02c3d9486138f8610
SHA1a499fe43f13de755c093667268dfcec2bc569ce0
SHA25643074360bd5d49ee16ba8eaa49dff9a2a06d26eddf4b0abce9b095527b0fdaee
SHA5124810b98b5ef77e2d88382039ed2efb4196310f265f606c1eb38dc4e12ea29c87062bfbf4471df9460fab847a0ff90f2a05b2e5c4309d0cba15e95b0d3218a9b7