Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:36
Behavioral task
behavioral1
Sample
21f0428f417000a999690425bf3a97c0.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
21f0428f417000a999690425bf3a97c0.exe
Resource
win10v2004-20231215-en
General
-
Target
21f0428f417000a999690425bf3a97c0.exe
-
Size
2.9MB
-
MD5
21f0428f417000a999690425bf3a97c0
-
SHA1
96e3d1b406b0cd3e2e63a21d7ee6fe82ca7694df
-
SHA256
e0097ee40ce3c1179ad38c11ea31cb59b34af5796f440d469bd123ce3634b2d1
-
SHA512
559e54036cfa3ad7ccbda4cbbd19369c6626cdeb1eb8cb7dac0565453f692a5ffec8cb643f4db954e16f15ac0dd868c051c2507bdee8a1d1d02896b0b6b12528
-
SSDEEP
49152:HbF3vXxtXhGd3ozQMsU02+P4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:7FhY3ors3dgg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 228 21f0428f417000a999690425bf3a97c0.exe -
Executes dropped EXE 1 IoCs
pid Process 228 21f0428f417000a999690425bf3a97c0.exe -
resource yara_rule behavioral2/memory/4824-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral2/files/0x0007000000023200-11.dat upx behavioral2/memory/228-13-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4824 21f0428f417000a999690425bf3a97c0.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4824 21f0428f417000a999690425bf3a97c0.exe 228 21f0428f417000a999690425bf3a97c0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4824 wrote to memory of 228 4824 21f0428f417000a999690425bf3a97c0.exe 68 PID 4824 wrote to memory of 228 4824 21f0428f417000a999690425bf3a97c0.exe 68 PID 4824 wrote to memory of 228 4824 21f0428f417000a999690425bf3a97c0.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\21f0428f417000a999690425bf3a97c0.exe"C:\Users\Admin\AppData\Local\Temp\21f0428f417000a999690425bf3a97c0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\21f0428f417000a999690425bf3a97c0.exeC:\Users\Admin\AppData\Local\Temp\21f0428f417000a999690425bf3a97c0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:228
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
332KB
MD5a722008bed835d5560a70990386aa732
SHA14c851d7f5bdcd15ef83665125429dbb3321d25be
SHA25698bad943183c71b90882352ca5401e6dd7654c65140779263f484d2efba26e6d
SHA512908de32b151d57c5425fa80cb8abed40b3c117c5e0bf591377d1c3eab6dacb4e888f58021bbfb1de1122151230c4325f6e7dcaa86f5d573e862cca16c3e6f1a1