Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 14:50
Static task
static1
Behavioral task
behavioral1
Sample
cca60f4392871dec3fe9a60f8489f12b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cca60f4392871dec3fe9a60f8489f12b.exe
Resource
win10v2004-20231215-en
General
-
Target
cca60f4392871dec3fe9a60f8489f12b.exe
-
Size
2.8MB
-
MD5
cca60f4392871dec3fe9a60f8489f12b
-
SHA1
e82697bdcf0711e0370118111f2dd38e2e03a62c
-
SHA256
ae0e8a33d286c871307cf40c13666739045b32582acd370279eeb8478a33b719
-
SHA512
a6a845b9b6bb4c814876bd858ddf5dbe96efae7fab48bcdd30b0c9f20072bb1d8a572f7a6d195be18b6eb9768c283cdb0bfd0bafc307f15415c4d7a23fb73490
-
SSDEEP
49152:Eqvx9e8Si/hvlpOpLVwMSZnNqee4DaQ2zu8XJohRHgI41V6BvPqz7M1vP1pRA0d:EOa0hvlENVTSZnmVa8XJ1uq7M1nHRb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2032 is-4J2EI.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2032 1972 cca60f4392871dec3fe9a60f8489f12b.exe 89 PID 1972 wrote to memory of 2032 1972 cca60f4392871dec3fe9a60f8489f12b.exe 89 PID 1972 wrote to memory of 2032 1972 cca60f4392871dec3fe9a60f8489f12b.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\cca60f4392871dec3fe9a60f8489f12b.exe"C:\Users\Admin\AppData\Local\Temp\cca60f4392871dec3fe9a60f8489f12b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\is-TA2E7.tmp\is-4J2EI.tmp"C:\Users\Admin\AppData\Local\Temp\is-TA2E7.tmp\is-4J2EI.tmp" /SL4 $B022E "C:\Users\Admin\AppData\Local\Temp\cca60f4392871dec3fe9a60f8489f12b.exe" 2696781 517122⤵
- Executes dropped EXE
PID:2032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
616KB
MD50e5fd0fc130e2380b08edca8f822f382
SHA1e36aacde42ac8f297d3bffb379c021639ef4c06a
SHA256d3f6c4e1b8e6d11661d4bdf79b438382bb5951e7a42cedbcac3ebbe88012373c
SHA512efaabebb37413eb2a689be4070827dbeb9ba8f88f6a90a3ed33225c68eb02e43e4760dcfdf3e59eba589db0519e9ac447035ef9b3822c0414ccebdc79a5bde37