Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 06:48

General

  • Target

    116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe

  • Size

    92KB

  • MD5

    116f2b637ed8c7b8a9a02fe6d7d9bdc3

  • SHA1

    fb7468b2a8927e969e5cf863c30957dba64939ac

  • SHA256

    0b5eb8c030fe2f8bc28bf320dbbb2f88ee9ed52c1f9f8f3df1d36509e8c560bf

  • SHA512

    f9c28e9d766b0f94d0523fd0bafa83e9c32dbba979e125360f571895098810584204b7e49d5377eb5fd2a55080c41939cebb27b2758ffcbaacac4525c68d7843

  • SSDEEP

    1536:SnZyoJ61G+K31783LU4fXWi8K1Sjzg+LIBjmNv1xZiRhzPh:S8oJ6Gj87UEXWi8K6g+sZ6fCzPh

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe
    "C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe
      C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\116f2b637ed8c7b8a9a02fe6d7d9bdc3.exe

    Filesize

    92KB

    MD5

    54b94524b0cca8d21c674523e2cd5bd7

    SHA1

    5d8dfd90e78a35d3e37b36eaa10cf44dd9788d05

    SHA256

    bfe1299e55dd3cd6bbd24f378d3d5f9352299d6ddd5a60a34d76c5288cf3cbc5

    SHA512

    34475a4cfac55e1c5e20240e782d7d05df9d6d6606fa7c748a3f2eb5f536749ef38e27533ef95873a1bd3d8b2bfcdb905239a597d1c31a38efc5a13e151dd6d3

  • memory/556-13-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/556-14-0x00000000001C0000-0x00000000001EF000-memory.dmp

    Filesize

    188KB

  • memory/556-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/556-22-0x0000000004D90000-0x0000000004DAB000-memory.dmp

    Filesize

    108KB

  • memory/4444-0-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

  • memory/4444-1-0x0000000001430000-0x000000000145F000-memory.dmp

    Filesize

    188KB

  • memory/4444-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4444-11-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB