Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 20:14
Static task
static1
Behavioral task
behavioral1
Sample
3a9f072f55b3c9a0008915b28790b507.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a9f072f55b3c9a0008915b28790b507.exe
Resource
win10v2004-20231222-en
General
-
Target
3a9f072f55b3c9a0008915b28790b507.exe
-
Size
361KB
-
MD5
3a9f072f55b3c9a0008915b28790b507
-
SHA1
f2c6068e6f30d22cb0ff74c58643b2e51e468b01
-
SHA256
b3766bf2e2c92774e4ce29cf14f260583d8604065204c6d755a5d942a8e87f1b
-
SHA512
fc6df10769b15dff0e01dbe02d3852a4415bb5f055953121a2e1b7bbc8907ed75335cacf70a2fbf28b67a7a3a6fe4f8915a09ddaa894d4a8f75a600b8b21406a
-
SSDEEP
6144:MTykDONo0jv7IoPfeq1ZzxRJbL7f5LAh36rSLL64j7W4+yQrOx5YsRC:MLry/neyx7f/A64j7P+tixhRC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3476 vbyhppvdp.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\tnfue\vbyhppvdp.exe 3a9f072f55b3c9a0008915b28790b507.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4444 wrote to memory of 3476 4444 3a9f072f55b3c9a0008915b28790b507.exe 90 PID 4444 wrote to memory of 3476 4444 3a9f072f55b3c9a0008915b28790b507.exe 90 PID 4444 wrote to memory of 3476 4444 3a9f072f55b3c9a0008915b28790b507.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe"C:\Users\Admin\AppData\Local\Temp\3a9f072f55b3c9a0008915b28790b507.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\tnfue\vbyhppvdp.exe"C:\Program Files (x86)\tnfue\vbyhppvdp.exe"2⤵
- Executes dropped EXE
PID:3476
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
380KB
MD51f5fcfeaa01b19682520f7eaf67e5d1f
SHA141f3beac77388594918ae5d298ddc82921606e7f
SHA2562dfeb3a4de326c4ec747109e2035ff76a4ed51ee60421854680f97d8f2cf133d
SHA512227cd8a861369a1f279465468af80bc2289e6084a885c9138f8bcd036c00e776db0771cd95e1e9fd6a715840152b76f7956c7dfbca9f869843c67820594cf0f4