Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 12:06
Static task
static1
Behavioral task
behavioral1
Sample
180085d856d91d3e6e02b6c257c95238.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
180085d856d91d3e6e02b6c257c95238.exe
Resource
win10v2004-20231215-en
General
-
Target
180085d856d91d3e6e02b6c257c95238.exe
-
Size
1.8MB
-
MD5
180085d856d91d3e6e02b6c257c95238
-
SHA1
5ee16b4b8b64009dc72beac3bb360b07907b0d0b
-
SHA256
39edc48d5880e4793b1593a42387132c7f44d3d0f74a216d97f5062ffc425461
-
SHA512
8e8fe679d6ef94b5313040dcd5186e57c2a3eaed9e4928757acc64987f6f9f4793839565a2bdcba73778449f3b7c6ed55fb4fefddcdab9f4014a05cce716b262
-
SSDEEP
49152:5ahNFV6kabM5i3pLNUB1O5WfcN8Cr+QYI9d1bCinXBgJ:QhNFUp535NFwENnr+1AbBRgJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2800 180085d856d91d3e6e02b6c257c95238.tmp -
Loads dropped DLL 1 IoCs
pid Process 2800 180085d856d91d3e6e02b6c257c95238.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4352 wrote to memory of 2800 4352 180085d856d91d3e6e02b6c257c95238.exe 88 PID 4352 wrote to memory of 2800 4352 180085d856d91d3e6e02b6c257c95238.exe 88 PID 4352 wrote to memory of 2800 4352 180085d856d91d3e6e02b6c257c95238.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\180085d856d91d3e6e02b6c257c95238.exe"C:\Users\Admin\AppData\Local\Temp\180085d856d91d3e6e02b6c257c95238.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\is-ACNIT.tmp\180085d856d91d3e6e02b6c257c95238.tmp"C:\Users\Admin\AppData\Local\Temp\is-ACNIT.tmp\180085d856d91d3e6e02b6c257c95238.tmp" /SL5="$501CE,1502797,54272,C:\Users\Admin\AppData\Local\Temp\180085d856d91d3e6e02b6c257c95238.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD5c765336f0dcf4efdcc2101eed67cd30c
SHA1fa0279f59738c5aa3b6b20106e109ccd77f895a7
SHA256c5177fdc6031728e10141745cd69edbc91c92d14411a2dec6e8e8caa4f74ab28
SHA51206a67ac37c20897967e2cad453793a6ef1c7804d4c578404f845daa88c859b15b0acb51642e6ad23ca6ba6549b02d5f6c98b1fa402004bdbf9d646abab7ec891