Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 01:58

General

  • Target

    0ae6a67be9ebfc240ddbfacfbed8fea7.exe

  • Size

    1.5MB

  • MD5

    0ae6a67be9ebfc240ddbfacfbed8fea7

  • SHA1

    19dee10961a4669477892224d4a70f806876fcee

  • SHA256

    23d0ec54bc45fde229f0435aeea2c75c4ecd92e3b174b5efd43d3f62749c8ba1

  • SHA512

    de9c6184966c6162918cdae1792107dc9576b93975540dc00f113fb6324cfc472f85593d43d07b5b5ad8fdef420bd95fcb4c9d815e899c46bace544c84d3cd49

  • SSDEEP

    24576:e9dG37Vk0R07Qanm9+XA9Jp8GnT26JSG5UEdPDeswt1T/LLTYwazt:lrq0R07QQmiA9cciG6E613VaZ

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe
    "C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4556
    • C:\Users\Admin\AppData\Local\Temp\470B.tmp
      "C:\Users\Admin\AppData\Local\Temp\470B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe 9B66A0538E940D7D6DB2E9345D3E7E0D52A5E295CFE55E20D52C780C8D12A1A5BF36120FAD61B17CA8C629856000D2DD289A2E77A73F569CDD5F1CB7840BB91A
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:1896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\470B.tmp

    Filesize

    348KB

    MD5

    d59ce307cda575d977b434d5503f251e

    SHA1

    0f43f78a399b7be449816adba1940d74cd3dbdeb

    SHA256

    aa35f0df6a1a60e9683831096d146bbd1d5df78ee8b3fe6f4375276f444377c0

    SHA512

    979cd1b0061b5ad9673338ffb28d9c9b638c324113f163cb474af1fe5a6b274b39034eb9aa91daf5414a03da375c14d6c791cb2ec65d95895917d632a099929f

  • memory/1896-9-0x0000000002F50000-0x0000000002FCA000-memory.dmp

    Filesize

    488KB

  • memory/1896-7-0x0000000000AA0000-0x0000000000C6E000-memory.dmp

    Filesize

    1.8MB

  • memory/4556-2-0x00000000024B0000-0x000000000252A000-memory.dmp

    Filesize

    488KB

  • memory/4556-0-0x0000000000190000-0x000000000035E000-memory.dmp

    Filesize

    1.8MB