Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 17:39
Static task
static1
Behavioral task
behavioral1
Sample
08e1c635597f27a0dbff1e597817eeb6.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
08e1c635597f27a0dbff1e597817eeb6.exe
Resource
win10v2004-20231215-en
General
-
Target
08e1c635597f27a0dbff1e597817eeb6.exe
-
Size
771KB
-
MD5
08e1c635597f27a0dbff1e597817eeb6
-
SHA1
ed0540aaecc304abd633b0648658c69834ac2e41
-
SHA256
bba320e2a5afe2eaffd524c6a78da76b8ea04411184aa27ff9e9ec73f7d8a8c6
-
SHA512
db8c1d4d4c95d0ff9afc99a5ba3c2d70d77b413eff60c9e334e821a00331c0e4940aa034562d26caef89e76ed4f6f7e36b8fa3f7fa85562cabecc0462d629871
-
SSDEEP
24576:n8cpoMs2omPh+P9yKVb10hJaothZ2/T6FBBB:n86NomPhQhZ/ofT
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1140 08e1c635597f27a0dbff1e597817eeb6.exe -
Executes dropped EXE 1 IoCs
pid Process 1140 08e1c635597f27a0dbff1e597817eeb6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2196 08e1c635597f27a0dbff1e597817eeb6.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2196 08e1c635597f27a0dbff1e597817eeb6.exe 1140 08e1c635597f27a0dbff1e597817eeb6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2196 wrote to memory of 1140 2196 08e1c635597f27a0dbff1e597817eeb6.exe 89 PID 2196 wrote to memory of 1140 2196 08e1c635597f27a0dbff1e597817eeb6.exe 89 PID 2196 wrote to memory of 1140 2196 08e1c635597f27a0dbff1e597817eeb6.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\08e1c635597f27a0dbff1e597817eeb6.exe"C:\Users\Admin\AppData\Local\Temp\08e1c635597f27a0dbff1e597817eeb6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\08e1c635597f27a0dbff1e597817eeb6.exeC:\Users\Admin\AppData\Local\Temp\08e1c635597f27a0dbff1e597817eeb6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
310KB
MD5b0817aac0a415b220203155fb2891a42
SHA1a524a395c4c5dbdcd0319bf84c14a0cfeb02abb6
SHA25665239ed998ddd5eab371456dffbd4eca6eba8f69aebff9b79f9d636f41472cda
SHA512772d90d73295918a68ff992b7e96a38aa521a40d968478c9bcb73e2d6211e8711cdd5b5799a80407fbfbb53056dd1a139c3434c155bbe4cbb44079eaf8b4cc15