Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 13:32

General

  • Target

    a58a331eb35ed202ac5d706571dac756.exe

  • Size

    1.9MB

  • MD5

    a58a331eb35ed202ac5d706571dac756

  • SHA1

    9c60af8b2d2b98719c6840628c51a5b13c3cc752

  • SHA256

    36d18ea06593f69af0ba40c640258c415ef14d28e6db8854f914ffa84c44ccd5

  • SHA512

    01b3d1601a597a9c98e2ca215b0f150d9ac0be428116cf8ce472e866d0ab3c303db0fdde96884c790820b43fbeee5556fe7f11941deec8e72f2be359527669f4

  • SSDEEP

    49152:Qoa1taC070duADsyPezoKS1QGCMQjBNDIHcsuL7Ct:Qoa1taC0RusUezfpnBNDIHRuLWt

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a58a331eb35ed202ac5d706571dac756.exe
    "C:\Users\Admin\AppData\Local\Temp\a58a331eb35ed202ac5d706571dac756.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\4D64.tmp
      "C:\Users\Admin\AppData\Local\Temp\4D64.tmp" --splashC:\Users\Admin\AppData\Local\Temp\a58a331eb35ed202ac5d706571dac756.exe 265A5796B4C38A554B45CCF8F0DC82DBADC06DD9FF9B4D46D45DCDC3CAAB0689CC802A1E6E2B60FFFCCBE178F849DD018366D7536A39447880A75E238ED6E615
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2208

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4D64.tmp

    Filesize

    958KB

    MD5

    1b2dca068a0d39b2891f653782646995

    SHA1

    508ef980816b7903e49e2b06bbf692b4f3123857

    SHA256

    fbe14327c58bf84310f34dde1653ee8ae2217236467cf06709f1ed00b2400094

    SHA512

    bd6f1cefc2568816520823b6423c17a72eeb089be58d95bbcb023257c6d152c761b750247f3d9a8d0f217ef7013d0ecf5c8d9f5565a98b002e554629d2c69441

  • C:\Users\Admin\AppData\Local\Temp\4D64.tmp

    Filesize

    1.1MB

    MD5

    594251f6f2a5f0b34a55b79f4db1c016

    SHA1

    4034b270fafc1e2ba7a54e75d8a9c131e761119a

    SHA256

    6680bb8821ef72bb475c9646af490f4577bfc78a2c04cdf4caf17c454a6d583b

    SHA512

    be87ead0eab619096a053212f681fb20c24c8ead41c74914e09bfc167a3c15bbfa744dd9fb199db1efc47548ccc68e62991043a1d4d1893c4747750f75033250

  • memory/2208-5-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB

  • memory/2724-0-0x0000000000400000-0x00000000005E6000-memory.dmp

    Filesize

    1.9MB