Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 13:31
Static task
static1
Behavioral task
behavioral1
Sample
53a636842a03c2324287d645ffc1636d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
53a636842a03c2324287d645ffc1636d.exe
Resource
win10v2004-20231222-en
General
-
Target
53a636842a03c2324287d645ffc1636d.exe
-
Size
385KB
-
MD5
53a636842a03c2324287d645ffc1636d
-
SHA1
5ee37962de011768ec3990d12a9689ea27b3127d
-
SHA256
9854ba85fdeebc58e4e8f0fd3d77afbe6af528c6c27061775d13bfaa1e59c6ab
-
SHA512
244c0f40f96af062ae0962d6467eac6abd4afec7a1431adbaeba64a1b64e30ceff0649d3ab6a5766810410af798db3d14b0df18b555fd568c7348c5dc7f0760e
-
SSDEEP
12288:GAzC/O6vRVvEFA1exJ4hcsIlb7odUKz1zPmV+tkB:GUC/O6vXvylPHxMdU+xPmc2B
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 224 53a636842a03c2324287d645ffc1636d.exe -
Executes dropped EXE 1 IoCs
pid Process 224 53a636842a03c2324287d645ffc1636d.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3620 53a636842a03c2324287d645ffc1636d.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3620 53a636842a03c2324287d645ffc1636d.exe 224 53a636842a03c2324287d645ffc1636d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3620 wrote to memory of 224 3620 53a636842a03c2324287d645ffc1636d.exe 89 PID 3620 wrote to memory of 224 3620 53a636842a03c2324287d645ffc1636d.exe 89 PID 3620 wrote to memory of 224 3620 53a636842a03c2324287d645ffc1636d.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\53a636842a03c2324287d645ffc1636d.exe"C:\Users\Admin\AppData\Local\Temp\53a636842a03c2324287d645ffc1636d.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\53a636842a03c2324287d645ffc1636d.exeC:\Users\Admin\AppData\Local\Temp\53a636842a03c2324287d645ffc1636d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5c019463675e1926e72abe880b157afb2
SHA1603b0a2f68716a9af772ac8ab3caa39992f65569
SHA256297e4677752037c8c6394417b9a233b8d39cd427a7aa5933688512dbd10ecde6
SHA512f37dd6eaffd37c534077506cfa88abbe486f0733ecc4e7c2e787fcba9df080ad154ec1f54ddf2805230d0a6759c530a4186b4e76d32eefc1117fa0cf55831088