Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 05:32
Static task
static1
Behavioral task
behavioral1
Sample
577fad3e53e76238c2fcc8d7106cba06.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
577fad3e53e76238c2fcc8d7106cba06.exe
Resource
win10v2004-20231215-en
General
-
Target
577fad3e53e76238c2fcc8d7106cba06.exe
-
Size
779KB
-
MD5
577fad3e53e76238c2fcc8d7106cba06
-
SHA1
dc19d9f4f278c4f13fe6cc6ebe39bb3a3e995070
-
SHA256
090d879dba019310bc6866ff848447fe7567557ca4586c64fa8b7d79adbd1b0d
-
SHA512
edc297a1717fa2785524051ded46741ea22a20d8303bbd533c061d03d3906d9048ac07c827aa74171ae1e6a324c66c7b5435f89a5b9bb23846627195e46021cd
-
SSDEEP
24576:7zXKqa8SEijjC+37li4daoInr1YSfi6HfRG7T2OuGjMi0CY38:7z6qaakjC+3s4da1nHzfKDbY38
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2032 qds.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\grwyehqm\qds.exe 577fad3e53e76238c2fcc8d7106cba06.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2032 2292 577fad3e53e76238c2fcc8d7106cba06.exe 19 PID 2292 wrote to memory of 2032 2292 577fad3e53e76238c2fcc8d7106cba06.exe 19 PID 2292 wrote to memory of 2032 2292 577fad3e53e76238c2fcc8d7106cba06.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\577fad3e53e76238c2fcc8d7106cba06.exe"C:\Users\Admin\AppData\Local\Temp\577fad3e53e76238c2fcc8d7106cba06.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\grwyehqm\qds.exe"C:\Program Files (x86)\grwyehqm\qds.exe"2⤵
- Executes dropped EXE
PID:2032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5db281d63f67a501e777ff46d7ce7a77b
SHA1622db3f10ca287f0710e1fb837cf946bf5e74005
SHA256c8b2e47b5cb7bd2bc752843bcf44a1cb449989de98ba63b2dbee908a832a9c8c
SHA51275a144659a5959e39be098a850c7613ffdedfcbcd145fbca4b1cc98dda79bfc994ad413b684aff0dc54648fab92bd5196bd4369cdb7d2053a938af870f55ffc2