Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2024, 07:59

General

  • Target

    432b9578c0ad9ed418d57d9bb51bcd20.exe

  • Size

    24KB

  • MD5

    432b9578c0ad9ed418d57d9bb51bcd20

  • SHA1

    3910483a8d1e11140bb42f01c328361c451e5572

  • SHA256

    98bc48acd900c6f06072b89c4e7e1bdb74b6c02e2aabfa9de65bff11955d807c

  • SHA512

    3c326b27a320faa3e4a8076a8b967146c5c925cfcd69651a9dd4c550b06a6dd84500b6bbbcb976567fa7b5502420cb0383a3f2cb0af3ceda106a2e7015ce4c00

  • SSDEEP

    384:uZyrOAVI7cfceEAQ8xZoQg0cHYaWjiS+QaRE1m0BFdTDjjwkA:uZJAGc3Edy+IcZzMT3q

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\432b9578c0ad9ed418d57d9bb51bcd20.exe
    "C:\Users\Admin\AppData\Local\Temp\432b9578c0ad9ed418d57d9bb51bcd20.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\Deleteme.bat
      2⤵
        PID:2180
      • C:\Windows\SysWOW64\NTdhcp.exe
        C:\Windows\system32\NTdhcp.exe
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:1516

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Deleteme.bat

      Filesize

      184B

      MD5

      1ac5db7354832c49c3e8804a1297d7d3

      SHA1

      ac7bfff8f7f2befed4a2449ee6a55333cfdccaf0

      SHA256

      e22a01e7b5684edde87064fa210ff8c4816b446f4046adca31e6b86178980361

      SHA512

      f4204623381555eaa3a74394089ac65ba3a88ed0e099f883eb657e8f4945a23d44f86dc2fd0a5ea2a3e1a7500174ead831e6eae372691b99109a9b45a600d4ee

    • C:\Windows\SysWOW64\NTdhcp.exe

      Filesize

      24KB

      MD5

      432b9578c0ad9ed418d57d9bb51bcd20

      SHA1

      3910483a8d1e11140bb42f01c328361c451e5572

      SHA256

      98bc48acd900c6f06072b89c4e7e1bdb74b6c02e2aabfa9de65bff11955d807c

      SHA512

      3c326b27a320faa3e4a8076a8b967146c5c925cfcd69651a9dd4c550b06a6dd84500b6bbbcb976567fa7b5502420cb0383a3f2cb0af3ceda106a2e7015ce4c00

    • memory/1516-6-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/4376-0-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

    • memory/4376-9-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB