Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 16:14
Behavioral task
behavioral1
Sample
ec2cd68c39b0f801d3d4567410735720.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ec2cd68c39b0f801d3d4567410735720.exe
Resource
win10v2004-20231215-en
General
-
Target
ec2cd68c39b0f801d3d4567410735720.exe
-
Size
1.3MB
-
MD5
ec2cd68c39b0f801d3d4567410735720
-
SHA1
f6d452e3df0a70bdbd85e082d32a0b6b6fbf10c1
-
SHA256
c048541bc9b490e97d68b40e4f5c7e7b3d14213875b05ee397cdf767beb49ba5
-
SHA512
0e8daa92b63446210d75323d4db823198f631ab35a6452dfa38abe5dee2bce11f3cd63c76bcaa331d19ea3269ba3288955e981bbcf7f1648a2f32258249b01bd
-
SSDEEP
24576:K4hJ0gAeWkpQG2WwvE0T3p+DRFN41o5iWq7wTLh2AxSvuxNa2fU9/9Us:K4hJ0g/jj2WeE43ps80dqJAcvXR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1964 ec2cd68c39b0f801d3d4567410735720.exe -
Executes dropped EXE 1 IoCs
pid Process 1964 ec2cd68c39b0f801d3d4567410735720.exe -
resource yara_rule behavioral2/memory/4592-0-0x0000000000400000-0x00000000008E7000-memory.dmp upx behavioral2/memory/1964-14-0x0000000000400000-0x00000000008E7000-memory.dmp upx behavioral2/files/0x000300000001f45f-11.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4592 ec2cd68c39b0f801d3d4567410735720.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4592 ec2cd68c39b0f801d3d4567410735720.exe 1964 ec2cd68c39b0f801d3d4567410735720.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4592 wrote to memory of 1964 4592 ec2cd68c39b0f801d3d4567410735720.exe 19 PID 4592 wrote to memory of 1964 4592 ec2cd68c39b0f801d3d4567410735720.exe 19 PID 4592 wrote to memory of 1964 4592 ec2cd68c39b0f801d3d4567410735720.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec2cd68c39b0f801d3d4567410735720.exe"C:\Users\Admin\AppData\Local\Temp\ec2cd68c39b0f801d3d4567410735720.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\ec2cd68c39b0f801d3d4567410735720.exeC:\Users\Admin\AppData\Local\Temp\ec2cd68c39b0f801d3d4567410735720.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1964
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD55514e592384553281ce3f9f3fa0c43d9
SHA111ec945f53aae585ae9add268820ecf37b6d9675
SHA2560484509106d28bc4211226f865bca024e9ea5f6d27d66da326c375209d562035
SHA5126fde36c60a2ab1425d387fcf6bb09bdfac873c029e9de3ba9eb6afe98782332a1f10313bc9e574dc2af1b8cb6a280affcdf73499397d278f7a4712b6de99c5a7