Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
3c3ff58e99a2b818a41f6f5f82c32bd5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3c3ff58e99a2b818a41f6f5f82c32bd5.exe
Resource
win10v2004-20231215-en
General
-
Target
3c3ff58e99a2b818a41f6f5f82c32bd5.exe
-
Size
649KB
-
MD5
3c3ff58e99a2b818a41f6f5f82c32bd5
-
SHA1
ef7c507754df4ee5bc39134b7a06994c27e402d1
-
SHA256
b16837613a15d4fd41945f8921ceafc014b33f8956e2796e2ccec570b63e9de4
-
SHA512
771fce8976c1d1e9836edfc692aa54433894e2795dae7ebfd6eade395cefd35e01facac4e83a7e77230a2585e9068fc162e3789e9a52f62e8459a6bbd71a1852
-
SSDEEP
12288:MLry/neyx7f/A64j7P+tixhT8n3qBmc1YkVY8606tVY3YuYcvuIH5:qKeyxTAJj7P+yW6mc1Y9iVvuW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4332 xgurxhxghtf.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\myuzt\xgurxhxghtf.exe 3c3ff58e99a2b818a41f6f5f82c32bd5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4420 wrote to memory of 4332 4420 3c3ff58e99a2b818a41f6f5f82c32bd5.exe 27 PID 4420 wrote to memory of 4332 4420 3c3ff58e99a2b818a41f6f5f82c32bd5.exe 27 PID 4420 wrote to memory of 4332 4420 3c3ff58e99a2b818a41f6f5f82c32bd5.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3ff58e99a2b818a41f6f5f82c32bd5.exe"C:\Users\Admin\AppData\Local\Temp\3c3ff58e99a2b818a41f6f5f82c32bd5.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Program Files (x86)\myuzt\xgurxhxghtf.exe"C:\Program Files (x86)\myuzt\xgurxhxghtf.exe"2⤵
- Executes dropped EXE
PID:4332
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
665KB
MD5b6adb15c672f92c7dc5cdbf5ecb5bae5
SHA1f1985fe71560bd45a3a7c0cece5a4648ec832867
SHA2568e51c64e31929669c7512eec5a13ca3d9324be4b048fdbac36532bbd0e412727
SHA512f94982e5e95c09ca7cf7c48de0ca1d2a2507fc4f5b6380372e831e14748b55d6c34ffe8a66e18621be1cf6667bc030e061901ca23ed9ea563ed9c5323e2fca42