Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 02:26

General

  • Target

    4ca21c6bd97b1f0edddd4125c19959c8.exe

  • Size

    1.2MB

  • MD5

    4ca21c6bd97b1f0edddd4125c19959c8

  • SHA1

    3fe62770dd1bd441d7de3e9597c78e96b1913191

  • SHA256

    33c0598a4f25546b028a22bbb0238c9d788f9625207ecd546ea55abfe7670982

  • SHA512

    1e5ea1993ffe9715798cfe6e75cd15bd274ce15c31d44ac8c79aaaa281fadec32f8cc94cbbb0239cacd322d0b8dce3c1e9471fc5b2bd4f4482635bc837a3238c

  • SSDEEP

    24576:VfOydJf48pgJef/deObHp77RL6qupeWpw6Dx5xlp2uRcYdDBKVYHZkgcAuMze4:VGMJf46fFhbHpAXpbW6V5xlp5RcYTTZJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe
    "C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Local\Temp\is-FLQCK.tmp\is-FBJR4.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FLQCK.tmp\is-FBJR4.tmp" /SL4 $50232 "C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe" 1014406 51200
      2⤵
      • Executes dropped EXE
      PID:4108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-FLQCK.tmp\is-FBJR4.tmp

    Filesize

    652KB

    MD5

    46570158ccae518dcf05602fea3e1bd8

    SHA1

    c71f09e0a4fcf9061fe8de67defb569361ed90b0

    SHA256

    eb289ef14e8f3b47081e1168690d1d95185dbfd1c3cdc5bfb074fd76a42cead0

    SHA512

    2721915717efd108cae39326d3644ecb55d1c47586e280b3f04f1b7f6a799ad9c0daaa3a410e667eaf7bed0265c9fee54cb899424d0935c2e6ab6ed896d29f97

  • memory/1156-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1156-1-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1156-3-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/1156-8-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/4108-9-0x0000000002340000-0x0000000002341000-memory.dmp

    Filesize

    4KB

  • memory/4108-15-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4108-17-0x0000000000400000-0x00000000004B2000-memory.dmp

    Filesize

    712KB

  • memory/4108-19-0x0000000002340000-0x0000000002341000-memory.dmp

    Filesize

    4KB