Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 20:26
Static task
static1
Behavioral task
behavioral1
Sample
10d0201de1a8bd609600f89c1f4e5dc5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
10d0201de1a8bd609600f89c1f4e5dc5.exe
Resource
win10v2004-20231222-en
General
-
Target
10d0201de1a8bd609600f89c1f4e5dc5.exe
-
Size
4.7MB
-
MD5
10d0201de1a8bd609600f89c1f4e5dc5
-
SHA1
0a3b35295bb8880ce0e6d18c649b8d29219eedf9
-
SHA256
69c2b26b30c6ba2d05b2e6c1f3d9c9655d5538cf8e7358d068abf6c6229fc8da
-
SHA512
7c1a76545704557edc604b6d3e02bdafbb401e4de1796df15e41f78a7ce1c9ec14164f855a8d515be6d3bf43a7eec0d2e78a8aa7cd98d02173f39d5ba006bf8a
-
SSDEEP
98304:e2a6lJo8LvZQkOIV5ZCJiJrsZ6biwvQ/RYgcf/pjVWTYZECWUcEnU:RlLjZgIVc6bqRgCSfWEU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 700 10d0201de1a8bd609600f89c1f4e5dc5.tmp -
Loads dropped DLL 2 IoCs
pid Process 700 10d0201de1a8bd609600f89c1f4e5dc5.tmp 700 10d0201de1a8bd609600f89c1f4e5dc5.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4836 wrote to memory of 700 4836 10d0201de1a8bd609600f89c1f4e5dc5.exe 89 PID 4836 wrote to memory of 700 4836 10d0201de1a8bd609600f89c1f4e5dc5.exe 89 PID 4836 wrote to memory of 700 4836 10d0201de1a8bd609600f89c1f4e5dc5.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\10d0201de1a8bd609600f89c1f4e5dc5.exe"C:\Users\Admin\AppData\Local\Temp\10d0201de1a8bd609600f89c1f4e5dc5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\is-NVQ3H.tmp\10d0201de1a8bd609600f89c1f4e5dc5.tmp"C:\Users\Admin\AppData\Local\Temp\is-NVQ3H.tmp\10d0201de1a8bd609600f89c1f4e5dc5.tmp" /SL5="$70056,4423017,85504,C:\Users\Admin\AppData\Local\Temp\10d0201de1a8bd609600f89c1f4e5dc5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
Filesize
905KB
MD54e4c348752dbdff4b3ce9797efeefbd7
SHA10316d3dbe970d6a41267726a6e0a9f15182a7e11
SHA256affbc9e6083e40d8b491e741124cb8d9b22e3ece1a1d03d93989e37b90e3cd58
SHA512c7c0b741d5140d116686dfd445d473354bad35b435468c64a6d87639db3669debbd15bedcbdee0a2251e268fc4d51fc087784e88c5387776ca6f758dbbe2b89d
-
Filesize
771KB
MD5baa01ce49f87f1b7e0e1d87d9e549a9b
SHA15587dad8ed646a436cbf9fde4c1e4a69c49d506f
SHA2568f47b2787e995afabf3c226e272a6fef7da60c3ed38353ada8bf2bc529368754
SHA51243a8f63dc202c61bdbb25883b5754db337e036b7dc3de0a9c3cf4647f2048ba8aec2e83a537bbc32757c977b68daeae14433e549213dbfca24e1591b47e1a240