Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 07:10

General

  • Target

    11d05a975550270ffa1ec4e4e04161c4.exe

  • Size

    2.5MB

  • MD5

    11d05a975550270ffa1ec4e4e04161c4

  • SHA1

    ae19df218b8d3081ad39ddafdff1bae639a77beb

  • SHA256

    6b969267e7cc6e6ec7fb932213be02840e6fc8a954a23bf8a75597a1f4f3b8cc

  • SHA512

    3e3aad591aaad5ff3c45560896cdcc20b8253f4da2f96258d56f8126118b21b225ee1cae7865dc528a1e55c427f6c96a6a3c601f66b235d332999a754cf64a37

  • SSDEEP

    49152:5aclqf2OOHad9Fh5kS7WykeJxGT/Yi9USNQAhdYucinXBgJ:Qclq+16P16mfGrYFSzj3RgJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\11d05a975550270ffa1ec4e4e04161c4.exe
    "C:\Users\Admin\AppData\Local\Temp\11d05a975550270ffa1ec4e4e04161c4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Users\Admin\AppData\Local\Temp\is-NHJL5.tmp\11d05a975550270ffa1ec4e4e04161c4.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-NHJL5.tmp\11d05a975550270ffa1ec4e4e04161c4.tmp" /SL5="$501D4,2263962,54272,C:\Users\Admin\AppData\Local\Temp\11d05a975550270ffa1ec4e4e04161c4.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-H1KS1.tmp\Games.inf

    Filesize

    514B

    MD5

    92d57bbd6623a5a290719a8105a65b55

    SHA1

    9d351ebad5f604fce625590c0f5c426a3feeb174

    SHA256

    38451e6cb05705b10a75608b3b9b805ed8265847eb8f6397782868f4106ee622

    SHA512

    7c9311e126e2082591eacb05c9e27abe6fef3fa1038370eee96297474bc18d79c750bb4d8c1754bcb607f9a809d4d0b428d8fd7b30142a6981707a5e9fd2c0fe

  • C:\Users\Admin\AppData\Local\Temp\is-H1KS1.tmp\isxdl.dll

    Filesize

    49KB

    MD5

    02ecc74f7f91e9ffd84de708683236a6

    SHA1

    3532de0b77df8b0fc89e9c7eddec3fa71f98f5a2

    SHA256

    30ad8a0e1cee091ca48c771adb2e76baf1a7d54b9f60dc47f54dfdc2d6f6691e

    SHA512

    a3fdaa651f82428395bc412a2a04fce673768d3ef088b3748addf337d95464eb141ae7c286bff5c705eae05dd7b38207629588ae7e89ada15269463cd7acf541

  • C:\Users\Admin\AppData\Local\Temp\is-NHJL5.tmp\11d05a975550270ffa1ec4e4e04161c4.tmp

    Filesize

    42KB

    MD5

    8a6da3835881024c35fc1769bdce90b9

    SHA1

    d9b452f08f9cd5bd598c4ef53720cf4bd37e2969

    SHA256

    807348d1ae7e60d975cffb596b8e3761f9627c2f77ffb235dc5eb8ebd6b510eb

    SHA512

    bf72b18c84d0e6ab5695950d368f8ec1b4cccac7f619a6cc51190fb064d0bdb0d8e7eac510118ec19b9ad4d0f19761ddd90a40222165bd3822329c76c03acb61

  • C:\Users\Admin\AppData\Local\Temp\is-NHJL5.tmp\11d05a975550270ffa1ec4e4e04161c4.tmp

    Filesize

    94KB

    MD5

    abda6d19c265cc1a24b99d707e77db82

    SHA1

    f0222b47b81bd0cc7b964a72381630c0755a19d9

    SHA256

    d9fb8d0bc1271aadc414dd6cabb1d7722ee61fc41edfd54e3cb3fb722b4fd093

    SHA512

    37572c2c9cf4fe0af84eadaf970c1d4e3e4be621c8500d39108a6e8f2783e1f14b44af7c3c6414513fed64f791757968cdbeedad34d7d51865652d1909f00735

  • memory/3328-2-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3328-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3328-37-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4092-7-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB

  • memory/4092-38-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

  • memory/4092-41-0x00000000007A0000-0x00000000007A1000-memory.dmp

    Filesize

    4KB