Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 05:00
Static task
static1
Behavioral task
behavioral1
Sample
6c04cf46bb52dfbab35ec9a53df2c393.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6c04cf46bb52dfbab35ec9a53df2c393.exe
Resource
win10v2004-20231215-en
General
-
Target
6c04cf46bb52dfbab35ec9a53df2c393.exe
-
Size
1.9MB
-
MD5
6c04cf46bb52dfbab35ec9a53df2c393
-
SHA1
09b02618d7fefa550dff1f4070ad855d3956f750
-
SHA256
ab7bcdc25afedfe46bea06a4d886e175eae6f23cd956ee0ec0601cdb056064b3
-
SHA512
a3b6fd3ea7af51a72d50de86ff228257a6cbaefef32dc49243a26ad97679c61bc59a462984b69f2290dfe829a548ebf0cac9d8a8a9953d6123aa81bb95c15c55
-
SSDEEP
24576:N2oo60HPdt+1CRiY2eOBvcj3u10dNvgjO84dkDnI21PSJI1L23VFZ1c9JmJlQR91:Qoa1taC070dcn02w529JmJlP8eyZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 60 514C.tmp -
Executes dropped EXE 1 IoCs
pid Process 60 514C.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3248 wrote to memory of 60 3248 6c04cf46bb52dfbab35ec9a53df2c393.exe 37 PID 3248 wrote to memory of 60 3248 6c04cf46bb52dfbab35ec9a53df2c393.exe 37 PID 3248 wrote to memory of 60 3248 6c04cf46bb52dfbab35ec9a53df2c393.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c04cf46bb52dfbab35ec9a53df2c393.exe"C:\Users\Admin\AppData\Local\Temp\6c04cf46bb52dfbab35ec9a53df2c393.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp" --splashC:\Users\Admin\AppData\Local\Temp\6c04cf46bb52dfbab35ec9a53df2c393.exe 6FC4354422D686AF304410A0033CAAEC2248C4CEA2BE6E56C414D58E749F34065AF6190A1C2C2E1F724DC97E6F4D05E0264C086355A6016FFC3FA67C661A017B2⤵
- Deletes itself
- Executes dropped EXE
PID:60
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD525908b0107c123549a7fb37004089375
SHA11195ae8798aeadb49658d0e0b1e2fc0db53e7500
SHA256548c73c919ba08e4a3530ff2642904ebddade0c1e4de17e8334041538df7b2e1
SHA512f8bea9d4a58795fa74f0ab4c9d84320dd119f4452808d8a5b055dd86625792b2be01a259fe616607870a0bf9c59e4e0754bab433ec68f3124689dd20e4a630c2
-
Filesize
57KB
MD57ff882fb898c89ec0985718631a38882
SHA1effa1ff623cc7250e69972088f119fe8ac86edd8
SHA2565f66e360bee542c48fe6283b3caf64d609275d0ecdbfdd50f19825f61974ad18
SHA51213957f752f0a78c2c0ef36d2b2ba3a2b37de4923801e501a2cbeced586a136628c4ed5ee0246147830ecfb4441f0e7f6b452cfc91a649e3a773b2ce656be53c6