Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 18:08
Static task
static1
Behavioral task
behavioral1
Sample
419011f4e0e4e2eaf1351a50702e769a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
419011f4e0e4e2eaf1351a50702e769a.exe
Resource
win10v2004-20231215-en
General
-
Target
419011f4e0e4e2eaf1351a50702e769a.exe
-
Size
385KB
-
MD5
419011f4e0e4e2eaf1351a50702e769a
-
SHA1
3b437cc7a394fb09d6f2463a3710045310258ba8
-
SHA256
c09164dd2eb417fb38dbc2f754f15385dc4191b86ac502b9f6c11a5b13b84696
-
SHA512
9fd39a7e91ae60d88eabfea214fedf155cfefe8b50727b0a169c42e95f26fdaae0ea1d63cd2fc1a0976c661af1ec96236d6e31a88005721c8e123ef723db19e6
-
SSDEEP
6144:/zhPi5C31VOKtttU31Dq145tR6RVDaL1RW1tcXrIB5CCPx624np+iftnwB:VPWC31Ptm1B96RpSRW7cXY5awimB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 5076 419011f4e0e4e2eaf1351a50702e769a.exe -
Executes dropped EXE 1 IoCs
pid Process 5076 419011f4e0e4e2eaf1351a50702e769a.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5056 419011f4e0e4e2eaf1351a50702e769a.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 5056 419011f4e0e4e2eaf1351a50702e769a.exe 5076 419011f4e0e4e2eaf1351a50702e769a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5056 wrote to memory of 5076 5056 419011f4e0e4e2eaf1351a50702e769a.exe 19 PID 5056 wrote to memory of 5076 5056 419011f4e0e4e2eaf1351a50702e769a.exe 19 PID 5056 wrote to memory of 5076 5056 419011f4e0e4e2eaf1351a50702e769a.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe"C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exeC:\Users\Admin\AppData\Local\Temp\419011f4e0e4e2eaf1351a50702e769a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:5076
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD5eb71b4830d8e22d8999fd4f70c847a6b
SHA16f1caef5d54518285464bb09e8b8352733545406
SHA256931fef963029735980aec1fe3e063bea059cbe538b247b78e114e78fefcccc98
SHA5126bcefa9fb872e3ea23ab7a13b0694ba97e2a875ab81746e1531f68991f02b79e95e858ae3ad1508e7d4624c0caeab2d31260ed2d10a088bfb6d25984ef0e51dd