Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 22:20
Static task
static1
Behavioral task
behavioral1
Sample
3fae9881ebbc1dcc58e2cd072fb72995.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3fae9881ebbc1dcc58e2cd072fb72995.exe
Resource
win10v2004-20231215-en
General
-
Target
3fae9881ebbc1dcc58e2cd072fb72995.exe
-
Size
142KB
-
MD5
3fae9881ebbc1dcc58e2cd072fb72995
-
SHA1
7248b29202074b097ff2a85b1a304eace03494c5
-
SHA256
530848c17cc8937015c4c69a2e80fb6e885cb4fbf6b4c3ff6efbabde6f1e40aa
-
SHA512
f1f400fc2c586b0d0a3d0bbf6d1a688a15fff526e76f1c903fac0120a46e03c2ebaea73b6c7db0b0513ea1c3e8622bf375fce088be6b4b15549f6c58d7da81a7
-
SSDEEP
3072:inOn7t7XpdpCCTg/sxFgJKeqgKJ+BCRCAiAAGtoPkSDEABV6g9wv:iKpdcCrTdgKQ7AHocSV6gu
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2540 downloadmr.exe -
Loads dropped DLL 2 IoCs
pid Process 2496 3fae9881ebbc1dcc58e2cd072fb72995.exe 2496 3fae9881ebbc1dcc58e2cd072fb72995.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2540 downloadmr.exe 2540 downloadmr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2540 2496 3fae9881ebbc1dcc58e2cd072fb72995.exe 91 PID 2496 wrote to memory of 2540 2496 3fae9881ebbc1dcc58e2cd072fb72995.exe 91 PID 2496 wrote to memory of 2540 2496 3fae9881ebbc1dcc58e2cd072fb72995.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fae9881ebbc1dcc58e2cd072fb72995.exe"C:\Users\Admin\AppData\Local\Temp\3fae9881ebbc1dcc58e2cd072fb72995.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\nsh712B.tmp\downloadmr.exeC:\Users\Admin\AppData\Local\Temp\nsh712B.tmp\downloadmr.exe /u4d488269-6268-4c29-b4c2-79305bc06ebe /e1811782⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD55ebc73650256e9c8ddbcda231db829a1
SHA1988d4535e18754ab2a6248abae96c5697d7dbcd5
SHA2561eaa543842df7795404184e8892a1654b0773dbc9bd8b54c7fdb9e68f4355493
SHA512b21266e76fc7263af982a1336a766e47ccf348ed56b305dbb09f03574c9b2a7309f12200e80d86f9a251381be6e87a41206447f11c51899cb31fba10da1d5270
-
Filesize
122KB
MD5da254a8488b60244654e1cf4d6796cf8
SHA123d06f4589786652a3a226b5012a5520a3d03452
SHA2566d3b82a7ad74a1e88ae4d0f9176082130f1558fb3ff42a8b45ca8b80445efc2d
SHA512d311f90ad65441f6c7ae55220c2c3f117aa7601d083e6847e1b58b96c3c332d68a25d445310818396dc88678fb9ec5356f35a04a392c3d23746a2231e14b0a2e