Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    164s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 03:04

General

  • Target

    25a3de23f97d77d178e9611c87bb3a7d.exe

  • Size

    3.2MB

  • MD5

    25a3de23f97d77d178e9611c87bb3a7d

  • SHA1

    14d74b6eceaaacc3e928d6879728901f5fd95ede

  • SHA256

    13bd27ebe0b4495db98d79c16ff6aa90804cd26c2677740636db21a416d16ee6

  • SHA512

    435546b23d66dd56425e9a82ebfc2dc77df97f884eae79ecbdadc91728499c048d6ca54489b500094384252f7c21415a46061253c140a8efc35ea8e93c754193

  • SSDEEP

    98304:edDW1tS4cUQEPzMgz6tA5ESUpI75CgxVb1:iDMSQPT6tlSnJ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25a3de23f97d77d178e9611c87bb3a7d.exe
    "C:\Users\Admin\AppData\Local\Temp\25a3de23f97d77d178e9611c87bb3a7d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3180
    • C:\Users\Admin\AppData\Local\Temp\is-89VU3.tmp\is-DIMVJ.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-89VU3.tmp\is-DIMVJ.tmp" /SL4 $801E0 "C:\Users\Admin\AppData\Local\Temp\25a3de23f97d77d178e9611c87bb3a7d.exe" 3136220 52224
      2⤵
      • Executes dropped EXE
      PID:3868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-89VU3.tmp\is-DIMVJ.tmp

    Filesize

    647KB

    MD5

    b683339ce008e97a0243a0f83bca1e09

    SHA1

    a8a4c078225ec9d94912762bda3a745d83dbe8f4

    SHA256

    5c6b8a1ab73cd03140040a3093e0d8466c666cd3fe17e8660dbc1a30d0b6f925

    SHA512

    c39b2501f5887c363633c94b04d58396a0d285ff65963ed513e99ff2dd7f36da323904278c6a64b9f1f637aaeed17e3d9d40540baa9805369cc664a32c62c780

  • memory/3180-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/3180-2-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/3180-7-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/3868-8-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB

  • memory/3868-14-0x0000000000400000-0x00000000004B0000-memory.dmp

    Filesize

    704KB

  • memory/3868-19-0x0000000000750000-0x0000000000751000-memory.dmp

    Filesize

    4KB