Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
25a3de23f97d77d178e9611c87bb3a7d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
25a3de23f97d77d178e9611c87bb3a7d.exe
Resource
win10v2004-20231215-en
General
-
Target
25a3de23f97d77d178e9611c87bb3a7d.exe
-
Size
3.2MB
-
MD5
25a3de23f97d77d178e9611c87bb3a7d
-
SHA1
14d74b6eceaaacc3e928d6879728901f5fd95ede
-
SHA256
13bd27ebe0b4495db98d79c16ff6aa90804cd26c2677740636db21a416d16ee6
-
SHA512
435546b23d66dd56425e9a82ebfc2dc77df97f884eae79ecbdadc91728499c048d6ca54489b500094384252f7c21415a46061253c140a8efc35ea8e93c754193
-
SSDEEP
98304:edDW1tS4cUQEPzMgz6tA5ESUpI75CgxVb1:iDMSQPT6tlSnJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3868 is-DIMVJ.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3180 wrote to memory of 3868 3180 25a3de23f97d77d178e9611c87bb3a7d.exe 91 PID 3180 wrote to memory of 3868 3180 25a3de23f97d77d178e9611c87bb3a7d.exe 91 PID 3180 wrote to memory of 3868 3180 25a3de23f97d77d178e9611c87bb3a7d.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\25a3de23f97d77d178e9611c87bb3a7d.exe"C:\Users\Admin\AppData\Local\Temp\25a3de23f97d77d178e9611c87bb3a7d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\is-89VU3.tmp\is-DIMVJ.tmp"C:\Users\Admin\AppData\Local\Temp\is-89VU3.tmp\is-DIMVJ.tmp" /SL4 $801E0 "C:\Users\Admin\AppData\Local\Temp\25a3de23f97d77d178e9611c87bb3a7d.exe" 3136220 522242⤵
- Executes dropped EXE
PID:3868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD5b683339ce008e97a0243a0f83bca1e09
SHA1a8a4c078225ec9d94912762bda3a745d83dbe8f4
SHA2565c6b8a1ab73cd03140040a3093e0d8466c666cd3fe17e8660dbc1a30d0b6f925
SHA512c39b2501f5887c363633c94b04d58396a0d285ff65963ed513e99ff2dd7f36da323904278c6a64b9f1f637aaeed17e3d9d40540baa9805369cc664a32c62c780