Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 14:50

General

  • Target

    cca60f4392871dec3fe9a60f8489f12b.exe

  • Size

    2.8MB

  • MD5

    cca60f4392871dec3fe9a60f8489f12b

  • SHA1

    e82697bdcf0711e0370118111f2dd38e2e03a62c

  • SHA256

    ae0e8a33d286c871307cf40c13666739045b32582acd370279eeb8478a33b719

  • SHA512

    a6a845b9b6bb4c814876bd858ddf5dbe96efae7fab48bcdd30b0c9f20072bb1d8a572f7a6d195be18b6eb9768c283cdb0bfd0bafc307f15415c4d7a23fb73490

  • SSDEEP

    49152:Eqvx9e8Si/hvlpOpLVwMSZnNqee4DaQ2zu8XJohRHgI41V6BvPqz7M1vP1pRA0d:EOa0hvlENVTSZnmVa8XJ1uq7M1nHRb

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cca60f4392871dec3fe9a60f8489f12b.exe
    "C:\Users\Admin\AppData\Local\Temp\cca60f4392871dec3fe9a60f8489f12b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\is-TA2E7.tmp\is-4J2EI.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-TA2E7.tmp\is-4J2EI.tmp" /SL4 $B022E "C:\Users\Admin\AppData\Local\Temp\cca60f4392871dec3fe9a60f8489f12b.exe" 2696781 51712
      2⤵
      • Executes dropped EXE
      PID:2032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-TA2E7.tmp\is-4J2EI.tmp

    Filesize

    616KB

    MD5

    0e5fd0fc130e2380b08edca8f822f382

    SHA1

    e36aacde42ac8f297d3bffb379c021639ef4c06a

    SHA256

    d3f6c4e1b8e6d11661d4bdf79b438382bb5951e7a42cedbcac3ebbe88012373c

    SHA512

    efaabebb37413eb2a689be4070827dbeb9ba8f88f6a90a3ed33225c68eb02e43e4760dcfdf3e59eba589db0519e9ac447035ef9b3822c0414ccebdc79a5bde37

  • memory/1972-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1972-10-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2032-6-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB

  • memory/2032-11-0x0000000000400000-0x00000000004A8000-memory.dmp

    Filesize

    672KB

  • memory/2032-14-0x0000000002230000-0x0000000002231000-memory.dmp

    Filesize

    4KB