Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 15:56

General

  • Target

    469f9680ca8fbec39203a01487f8407f.exe

  • Size

    198KB

  • MD5

    469f9680ca8fbec39203a01487f8407f

  • SHA1

    fac1daf36a48d42174f79beefa26f4cc6afa0e74

  • SHA256

    22751aa69266bf620afcc2ff8fb3e4a75d089093f8788c3f26d2c1d130ab85e2

  • SHA512

    ad81f844cb653bd3c6ec9b1a56f4a77d5e735606af25cec013ca132214434eca8a67a03d2c7fc284298e57f0264f8700210ef55bf1ad1067296162b4b176f8ec

  • SSDEEP

    3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/g8NkgnYQ:o68i3odBiTl2+TCU/Bk8N

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\469f9680ca8fbec39203a01487f8407f.exe
    "C:\Users\Admin\AppData\Local\Temp\469f9680ca8fbec39203a01487f8407f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4048
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\bugMAKER.bat
      2⤵
        PID:5052

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4048-24-0x0000000000400000-0x000000000042D000-memory.dmp

      Filesize

      180KB