Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
4ca21c6bd97b1f0edddd4125c19959c8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4ca21c6bd97b1f0edddd4125c19959c8.exe
Resource
win10v2004-20231215-en
General
-
Target
4ca21c6bd97b1f0edddd4125c19959c8.exe
-
Size
1.2MB
-
MD5
4ca21c6bd97b1f0edddd4125c19959c8
-
SHA1
3fe62770dd1bd441d7de3e9597c78e96b1913191
-
SHA256
33c0598a4f25546b028a22bbb0238c9d788f9625207ecd546ea55abfe7670982
-
SHA512
1e5ea1993ffe9715798cfe6e75cd15bd274ce15c31d44ac8c79aaaa281fadec32f8cc94cbbb0239cacd322d0b8dce3c1e9471fc5b2bd4f4482635bc837a3238c
-
SSDEEP
24576:VfOydJf48pgJef/deObHp77RL6qupeWpw6Dx5xlp2uRcYdDBKVYHZkgcAuMze4:VGMJf46fFhbHpAXpbW6V5xlp5RcYTTZJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4108 is-FBJR4.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1156 wrote to memory of 4108 1156 4ca21c6bd97b1f0edddd4125c19959c8.exe 91 PID 1156 wrote to memory of 4108 1156 4ca21c6bd97b1f0edddd4125c19959c8.exe 91 PID 1156 wrote to memory of 4108 1156 4ca21c6bd97b1f0edddd4125c19959c8.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe"C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\is-FLQCK.tmp\is-FBJR4.tmp"C:\Users\Admin\AppData\Local\Temp\is-FLQCK.tmp\is-FBJR4.tmp" /SL4 $50232 "C:\Users\Admin\AppData\Local\Temp\4ca21c6bd97b1f0edddd4125c19959c8.exe" 1014406 512002⤵
- Executes dropped EXE
PID:4108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
652KB
MD546570158ccae518dcf05602fea3e1bd8
SHA1c71f09e0a4fcf9061fe8de67defb569361ed90b0
SHA256eb289ef14e8f3b47081e1168690d1d95185dbfd1c3cdc5bfb074fd76a42cead0
SHA5122721915717efd108cae39326d3644ecb55d1c47586e280b3f04f1b7f6a799ad9c0daaa3a410e667eaf7bed0265c9fee54cb899424d0935c2e6ab6ed896d29f97