Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 15:05
Behavioral task
behavioral1
Sample
77bc02e8c565cee1288a6f918711136c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
77bc02e8c565cee1288a6f918711136c.exe
Resource
win10v2004-20231215-en
General
-
Target
77bc02e8c565cee1288a6f918711136c.exe
-
Size
28KB
-
MD5
77bc02e8c565cee1288a6f918711136c
-
SHA1
50283f269435ed351cd9a04e605ed607617dc744
-
SHA256
cf239f78ac1b7e72e301dd8f0482866e8ff664bc4c9ad7f78648b466dbeef9ff
-
SHA512
4b3cb9347d909c2cee960d4726a4800f556f9ae22c610a15fb86febe69281b7c835376e551965fc6d55fbed6a0c9ce0ba5761d62077e4bf78f19106919da344c
-
SSDEEP
768:5CUb3foaqTPawJG1VdPdEPcurxbjAmKmrV:QUL9qba+GvdPdEUWxbkmZV
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2196-0-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral2/memory/2196-4-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral2/memory/3552-5-0x0000000000400000-0x0000000000415000-memory.dmp upx behavioral2/memory/3552-8-0x0000000000400000-0x0000000000415000-memory.dmp upx -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 204.97.212.10 Destination IP 83.220.128.65 Destination IP 4.2.2.1 Destination IP 193.182.2.101 -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\svchost.exe:exe.exe 77bc02e8c565cee1288a6f918711136c.exe File created C:\Windows\SysWOW64\icf.exe 77bc02e8c565cee1288a6f918711136c.exe File opened for modification C:\Windows\SysWOW64\icf.exe 77bc02e8c565cee1288a6f918711136c.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2196 set thread context of 3552 2196 77bc02e8c565cee1288a6f918711136c.exe 17 -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2196 wrote to memory of 3552 2196 77bc02e8c565cee1288a6f918711136c.exe 17 PID 2196 wrote to memory of 3552 2196 77bc02e8c565cee1288a6f918711136c.exe 17 PID 2196 wrote to memory of 3552 2196 77bc02e8c565cee1288a6f918711136c.exe 17 PID 2196 wrote to memory of 3552 2196 77bc02e8c565cee1288a6f918711136c.exe 17 PID 2196 wrote to memory of 2268 2196 77bc02e8c565cee1288a6f918711136c.exe 16 PID 2196 wrote to memory of 2268 2196 77bc02e8c565cee1288a6f918711136c.exe 16 PID 2196 wrote to memory of 2268 2196 77bc02e8c565cee1288a6f918711136c.exe 16
Processes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\10223619.bat1⤵PID:2268
-
C:\Windows\SysWOW64\svchost.exesvchost.exe1⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\77bc02e8c565cee1288a6f918711136c.exe"C:\Users\Admin\AppData\Local\Temp\77bc02e8c565cee1288a6f918711136c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2196
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238B
MD526c4818850bc5e64f37b207acd8960e5
SHA1475dc63ae801739954978de00ab75f0548382233
SHA25649b5135fda666d1901c7b3f18daae517bda5a26abd782058ab7da9cdb6b9dd88
SHA512d4b8c5d83bb22fbee6da5a4eee62e4576af3c30bfc8894fc213004a1cefaa3e1bcc2323b88b07ddacbeb1e2ff1b1cec33f1e2e1f1229b1d2c3d4160e6ddd1e87