Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    153s
  • max time network
    175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 11:47

General

  • Target

    89b48c2d597f74bbfeb9bcb3df410a81.exe

  • Size

    757KB

  • MD5

    89b48c2d597f74bbfeb9bcb3df410a81

  • SHA1

    4a1ff552926f5caf1892a2c96fa4fd0e1fb5fbf5

  • SHA256

    a7ac72fffdad0067658b52af3ad260c0b41b9e20876230743910b8715a74ea48

  • SHA512

    cb5a41b98b6715dedd633c18e8746e8fa336bbd125f58494e9501eab1506aced698ab647d569945e3450a87c7bb31c84511089a846dcd31b0e6c6e21a76ff01e

  • SSDEEP

    12288:VQi3O2gsv6m6URA3Phkzp1hf39Wkv8xwJC/:VQie2BChhgpdUMC/

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe
    "C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Users\Admin\AppData\Local\Temp\is-PV772.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PV772.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp" /SL5="$501F2,506086,422400,C:\Users\Admin\AppData\Local\Temp\89b48c2d597f74bbfeb9bcb3df410a81.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-46NPM.tmp\idp.dll

    Filesize

    216KB

    MD5

    8f995688085bced38ba7795f60a5e1d3

    SHA1

    5b1ad67a149c05c50d6e388527af5c8a0af4343a

    SHA256

    203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

    SHA512

    043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

  • C:\Users\Admin\AppData\Local\Temp\is-PV772.tmp\89b48c2d597f74bbfeb9bcb3df410a81.tmp

    Filesize

    1.0MB

    MD5

    090544331456bfb5de954f30519826f0

    SHA1

    8d0e1fa2d96e593f7f4318fa9e355c852b5b1fd4

    SHA256

    b32cbc6b83581d4dc39aa7106e983e693c5df0e0a28f146f0a37bc0c23442047

    SHA512

    03d5cbc044da526c8b6269a9122437b8d386530900e2b8452e4cf7b3d36fc895696cbe665e650a9afbdec4bad64a3dc0f6f5e1309e07f6f1407ec0643cac121d

  • memory/3020-5-0x00000000007C0000-0x00000000007C1000-memory.dmp

    Filesize

    4KB

  • memory/3020-17-0x0000000000400000-0x0000000000516000-memory.dmp

    Filesize

    1.1MB

  • memory/5060-0-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB

  • memory/5060-19-0x0000000000400000-0x000000000046D000-memory.dmp

    Filesize

    436KB