Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
0ae6a67be9ebfc240ddbfacfbed8fea7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0ae6a67be9ebfc240ddbfacfbed8fea7.exe
Resource
win10v2004-20231215-en
General
-
Target
0ae6a67be9ebfc240ddbfacfbed8fea7.exe
-
Size
1.5MB
-
MD5
0ae6a67be9ebfc240ddbfacfbed8fea7
-
SHA1
19dee10961a4669477892224d4a70f806876fcee
-
SHA256
23d0ec54bc45fde229f0435aeea2c75c4ecd92e3b174b5efd43d3f62749c8ba1
-
SHA512
de9c6184966c6162918cdae1792107dc9576b93975540dc00f113fb6324cfc472f85593d43d07b5b5ad8fdef420bd95fcb4c9d815e899c46bace544c84d3cd49
-
SSDEEP
24576:e9dG37Vk0R07Qanm9+XA9Jp8GnT26JSG5UEdPDeswt1T/LLTYwazt:lrq0R07QQmiA9cciG6E613VaZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1896 470B.tmp -
Executes dropped EXE 1 IoCs
pid Process 1896 470B.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4556 wrote to memory of 1896 4556 0ae6a67be9ebfc240ddbfacfbed8fea7.exe 21 PID 4556 wrote to memory of 1896 4556 0ae6a67be9ebfc240ddbfacfbed8fea7.exe 21 PID 4556 wrote to memory of 1896 4556 0ae6a67be9ebfc240ddbfacfbed8fea7.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe"C:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\0ae6a67be9ebfc240ddbfacfbed8fea7.exe 9B66A0538E940D7D6DB2E9345D3E7E0D52A5E295CFE55E20D52C780C8D12A1A5BF36120FAD61B17CA8C629856000D2DD289A2E77A73F569CDD5F1CB7840BB91A2⤵
- Deletes itself
- Executes dropped EXE
PID:1896
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
348KB
MD5d59ce307cda575d977b434d5503f251e
SHA10f43f78a399b7be449816adba1940d74cd3dbdeb
SHA256aa35f0df6a1a60e9683831096d146bbd1d5df78ee8b3fe6f4375276f444377c0
SHA512979cd1b0061b5ad9673338ffb28d9c9b638c324113f163cb474af1fe5a6b274b39034eb9aa91daf5414a03da375c14d6c791cb2ec65d95895917d632a099929f