Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 05:27

General

  • Target

    0ffbcee06e2f5040d464bcff95cd4d60.exe

  • Size

    2.3MB

  • MD5

    0ffbcee06e2f5040d464bcff95cd4d60

  • SHA1

    ae3c65c54c602255359ba660a83545bcd94bda7a

  • SHA256

    f9934e8e4104400baacd0b31891c3df7557a3283a443804c3cf6c43d3e378510

  • SHA512

    631b9d251ed9477683e3406083cbe1fc27e0597f00788b7a127d2192bc727ca8b9cf5bc63ce6f6694710d7a7b254ce6fcb9b729e33472a62644e8c433be705ff

  • SSDEEP

    49152:kuzFZ/0rAkC2Ct4BUZ3xu+JOkCw+VGtdrHJeKvgy:k+FerZC2CpZ3xu+BQSdjvz

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 52 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe
    "C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe
        "C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe"
        3⤵
        • Executes dropped EXE
        PID:5056
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:3432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0ffbcee06e2f5040d464bcff95cd4d60.exe

    Filesize

    2.3MB

    MD5

    d72bd058af4225304c130ccc30472c67

    SHA1

    654c3846145b4f4409e35f292bd883ef69730a58

    SHA256

    bd1edcda1022456ab38c50e30104dc7ec744902048c80cbff317975eb54c48a2

    SHA512

    7478491a03f561577e949bfb15d63dc6e918598cd277881dac0688717dbc4672f0732cf7f2348d9f9d4976fdd1a563d9727c3d99c74f8a263e72923e965b47a9

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    9e3c13b6556d5636b745d3e466d47467

    SHA1

    2ac1c19e268c49bc508f83fe3d20f495deb3e538

    SHA256

    20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8

    SHA512

    5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b

  • memory/1548-11-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3432-15-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3432-21-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3432-22-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3576-3-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/5056-9-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/5056-14-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/5056-16-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB