Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 08:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
130401c7bd47fd5772fe61ee7e37199a.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
130401c7bd47fd5772fe61ee7e37199a.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
130401c7bd47fd5772fe61ee7e37199a.exe
-
Size
209KB
-
MD5
130401c7bd47fd5772fe61ee7e37199a
-
SHA1
d3d4c6f8c16403ea0cafd0857ca51579a5d764f1
-
SHA256
8392e8ebc86eb5bebab49ea05619f7f52f350224d7d308e34be7d818aa85981c
-
SHA512
07b6c451f1ebe41671ba3369bf4622cab20de6591c547fd59862a6f557f60fc12f5a6f2051713ce92439c5b23ccdea0ce293af1dfcd43e063329c1c6ff53e77b
-
SSDEEP
6144:VltGmukwuqEBv9KgZI4Szs66U4e8lVkw2AnhW1Hg:NGmN1Z9uzsKF8f6n1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4680 u.dll 456 mpress.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2600 2764 130401c7bd47fd5772fe61ee7e37199a.exe 24 PID 2764 wrote to memory of 2600 2764 130401c7bd47fd5772fe61ee7e37199a.exe 24 PID 2764 wrote to memory of 2600 2764 130401c7bd47fd5772fe61ee7e37199a.exe 24 PID 2600 wrote to memory of 4680 2600 cmd.exe 17 PID 2600 wrote to memory of 4680 2600 cmd.exe 17 PID 2600 wrote to memory of 4680 2600 cmd.exe 17 PID 4680 wrote to memory of 456 4680 u.dll 23 PID 4680 wrote to memory of 456 4680 u.dll 23 PID 4680 wrote to memory of 456 4680 u.dll 23 PID 2600 wrote to memory of 2392 2600 cmd.exe 21 PID 2600 wrote to memory of 2392 2600 cmd.exe 21 PID 2600 wrote to memory of 2392 2600 cmd.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe"C:\Users\Admin\AppData\Local\Temp\130401c7bd47fd5772fe61ee7e37199a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4640.tmp\vir.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\u.dllu.dll -bat vir.bat -save 130401c7bd47fd5772fe61ee7e37199a.exe.com -include s.dll -overwrite -nodelete1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp\mpress.exe"C:\Users\Admin\AppData\Local\Temp\46BD.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe46BE.tmp"2⤵
- Executes dropped EXE
PID:456
-
-
C:\Windows\SysWOW64\calc.exeCALC.EXE1⤵PID:2392
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:2896