Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 12:21

General

  • Target

    185a2ca1884de3983a525cdd7104daa0.exe

  • Size

    267KB

  • MD5

    185a2ca1884de3983a525cdd7104daa0

  • SHA1

    131969f13c3e141e660aa219e90a78a07d390151

  • SHA256

    c7cc67bd019e049c62342206f2d2a7af46fc58a950d1ff1db958d7c09290b6df

  • SHA512

    eaa875e55522050870bb2742ee261f3efbb46448c5d3c8cb63c4ad60748bf17d6fa16e9f841d92a4c78f90c2b9f5bf6dcd7be232c07b7d753cd29c8baadd48e5

  • SSDEEP

    6144:KxZaCYILHJne0fIJQsSWUhM8CBesCbYE/o/G+O:K9YILH9yQLBhJCdKzg/G7

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe
    "C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe
      "C:\Users\Admin\AppData\Local\Temp\185a2ca1884de3983a525cdd7104daa0.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe
        "C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4336
  • C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe
    "C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe"
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
      "C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe" /i:3356
      2⤵
        PID:1360

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\WUOoTIbrGlRiZ\BlCPliQ5D.exe

      Filesize

      267KB

      MD5

      185a2ca1884de3983a525cdd7104daa0

      SHA1

      131969f13c3e141e660aa219e90a78a07d390151

      SHA256

      c7cc67bd019e049c62342206f2d2a7af46fc58a950d1ff1db958d7c09290b6df

      SHA512

      eaa875e55522050870bb2742ee261f3efbb46448c5d3c8cb63c4ad60748bf17d6fa16e9f841d92a4c78f90c2b9f5bf6dcd7be232c07b7d753cd29c8baadd48e5

    • C:\ProgramData\WUOoTIbrGlRiZ\RCX4C6A.tmp

      Filesize

      267KB

      MD5

      010433dde6ba48d2964d6cd30530c04d

      SHA1

      9680c2252ecb5fffae1747304206a3db1fa59426

      SHA256

      1117a2d1be29d064eb9b6a96af9489b8f6ca6d5fa0d74dced2505f5593835f68

      SHA512

      5a8c5c3f12871d35f8268655a039d2c52b471bd9e404b4af92597f142e051839240b5364af71dce53a53f67d5d9011c484c31195577fc3f0d7b1bf67efbcaa0e

    • memory/1360-38-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/1360-35-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2320-3-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2320-4-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2320-17-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2320-2-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/2320-0-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3356-25-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/3356-36-0x0000000000400000-0x000000000045E000-memory.dmp

      Filesize

      376KB

    • memory/4336-23-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB

    • memory/4580-1-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB