Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 00:36
Behavioral task
behavioral1
Sample
5501caddbf5e3131df193e7078996e9b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5501caddbf5e3131df193e7078996e9b.exe
Resource
win10v2004-20231215-en
General
-
Target
5501caddbf5e3131df193e7078996e9b.exe
-
Size
5.8MB
-
MD5
5501caddbf5e3131df193e7078996e9b
-
SHA1
69d9cb24271b4f39f3c45a0052545920088f8e36
-
SHA256
5593398cc4e792cd4403a30efbda651bc7d2185ac265e307b8959b9064476b34
-
SHA512
a452238ceaa7f8f4d7f5c42001424f9060abc36082244c244587295f9bc91696c032490d14b027b9dece2c813669dbedefb47839658345935f33da76e3528073
-
SSDEEP
98304:Co6LYQ5BlYZbXvpF2Yzc4HBUCczzM3ttrsR3BxnY3EAp4HBUCczzM3:CoALlYZbXB1zTWCxh+3XY4WC
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2404 5501caddbf5e3131df193e7078996e9b.exe -
Executes dropped EXE 1 IoCs
pid Process 2404 5501caddbf5e3131df193e7078996e9b.exe -
resource yara_rule behavioral2/memory/1356-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral2/memory/2404-13-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral2/files/0x000700000002304b-11.dat upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1356 5501caddbf5e3131df193e7078996e9b.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1356 5501caddbf5e3131df193e7078996e9b.exe 2404 5501caddbf5e3131df193e7078996e9b.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1356 wrote to memory of 2404 1356 5501caddbf5e3131df193e7078996e9b.exe 87 PID 1356 wrote to memory of 2404 1356 5501caddbf5e3131df193e7078996e9b.exe 87 PID 1356 wrote to memory of 2404 1356 5501caddbf5e3131df193e7078996e9b.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe"C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exeC:\Users\Admin\AppData\Local\Temp\5501caddbf5e3131df193e7078996e9b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2404
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
877KB
MD5a0081855f97d5e6405a6fafebbf0c41b
SHA11dd388db9c833d01235fc33ac62ed0db74d8ddc1
SHA256993daeed6e3ac3223d04dcbba73b7a27590db6a80d62d87f01c8334916768e02
SHA5123dc3a75257fddeacd99f9b628929e1ae01a775f1143456bbb93d31aee40a921a3d086cd5cd703199d1faf401aa69a605e25154b7c1fa8373e6f4afb1cb74ca89