Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 07:55

General

  • Target

    105e462ca9cd66e19c70d12ddb1cf5c1.exe

  • Size

    170KB

  • MD5

    105e462ca9cd66e19c70d12ddb1cf5c1

  • SHA1

    6b9a3aa84bbca8e634f33791fc9c3c3bf4cfcca4

  • SHA256

    3c9c30c90537b242913e54b31b45aac963ad5f2e5cd0ad69f5388341088c5002

  • SHA512

    5f17b7b921ea1d36faa6474eb66c6db97c5a432d4fc6f2a133f66f68eea12cca2bc0e3915b296e156b0880e9dacd444a80f9930b9685ef31f8cbde9a7eafeb8d

  • SSDEEP

    3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B89W:o68i3odBiTl2+TCU/EW

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\105e462ca9cd66e19c70d12ddb1cf5c1.exe
    "C:\Users\Admin\AppData\Local\Temp\105e462ca9cd66e19c70d12ddb1cf5c1.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
      2⤵
        PID:3432

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\bugMAKER.bat

      Filesize

      76B

      MD5

      08506809c2cec7138263383dedb88156

      SHA1

      a1e51ce74ba207b8badc156cc6e6c45f65f3a46b

      SHA256

      2393cc5cd4824b27dba5ab8c12b4d9dd1d506aca12c503d3efd4f018a6ee9168

      SHA512

      f975249457048927564704145c8839c4e389442b1a90c3149141b4860d6de02512d0c3cbc7eaa7ff15844f4e2d98c3d394ddc3751ad009d49e292489484169db

    • memory/2304-24-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB