Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 15:05

General

  • Target

    77bc02e8c565cee1288a6f918711136c.exe

  • Size

    28KB

  • MD5

    77bc02e8c565cee1288a6f918711136c

  • SHA1

    50283f269435ed351cd9a04e605ed607617dc744

  • SHA256

    cf239f78ac1b7e72e301dd8f0482866e8ff664bc4c9ad7f78648b466dbeef9ff

  • SHA512

    4b3cb9347d909c2cee960d4726a4800f556f9ae22c610a15fb86febe69281b7c835376e551965fc6d55fbed6a0c9ce0ba5761d62077e4bf78f19106919da344c

  • SSDEEP

    768:5CUb3foaqTPawJG1VdPdEPcurxbjAmKmrV:QUL9qba+GvdPdEUWxbkmZV

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\10223619.bat
    1⤵
      PID:2268
    • C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      1⤵
        PID:3552
      • C:\Users\Admin\AppData\Local\Temp\77bc02e8c565cee1288a6f918711136c.exe
        "C:\Users\Admin\AppData\Local\Temp\77bc02e8c565cee1288a6f918711136c.exe"
        1⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2196

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\10223619.bat

        Filesize

        238B

        MD5

        26c4818850bc5e64f37b207acd8960e5

        SHA1

        475dc63ae801739954978de00ab75f0548382233

        SHA256

        49b5135fda666d1901c7b3f18daae517bda5a26abd782058ab7da9cdb6b9dd88

        SHA512

        d4b8c5d83bb22fbee6da5a4eee62e4576af3c30bfc8894fc213004a1cefaa3e1bcc2323b88b07ddacbeb1e2ff1b1cec33f1e2e1f1229b1d2c3d4160e6ddd1e87

      • memory/2196-0-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/2196-4-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/3552-5-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB

      • memory/3552-8-0x0000000000400000-0x0000000000415000-memory.dmp

        Filesize

        84KB