Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2024, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
55a55d541bdbc613f58c4ba44853dc5e.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
55a55d541bdbc613f58c4ba44853dc5e.exe
Resource
win10v2004-20231222-en
General
-
Target
55a55d541bdbc613f58c4ba44853dc5e.exe
-
Size
20.0MB
-
MD5
55a55d541bdbc613f58c4ba44853dc5e
-
SHA1
8f17f2ff978843009ffe298da6f73c334901200a
-
SHA256
9100f6dcb4a3910c315ca6615622612058cb200476ef2015d2b3fba6a850d1fb
-
SHA512
ba5e7d78bbbe8f890bac77e163d156c2770d14d444f06be0256a86bcff6c4c071e3ea387431468e1e14195f9b98f049b53f2ec68e9eec727778b95d2373f2a79
-
SSDEEP
393216:i0fvHwVgI2Q0wyla7aT1egGDwsUCQBVKNI77P29/b/vw72299u2EXC0nPbFs75yT:i0fod4iaZkipKK3eFb/IJgC0TFsF5HIP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2108 is-ML0GO.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4556 wrote to memory of 2108 4556 55a55d541bdbc613f58c4ba44853dc5e.exe 24 PID 4556 wrote to memory of 2108 4556 55a55d541bdbc613f58c4ba44853dc5e.exe 24 PID 4556 wrote to memory of 2108 4556 55a55d541bdbc613f58c4ba44853dc5e.exe 24
Processes
-
C:\Users\Admin\AppData\Local\Temp\55a55d541bdbc613f58c4ba44853dc5e.exe"C:\Users\Admin\AppData\Local\Temp\55a55d541bdbc613f58c4ba44853dc5e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\is-RDDMC.tmp\is-ML0GO.tmp"C:\Users\Admin\AppData\Local\Temp\is-RDDMC.tmp\is-ML0GO.tmp" /SL4 $F0044 "C:\Users\Admin\AppData\Local\Temp\55a55d541bdbc613f58c4ba44853dc5e.exe" 20761769 522242⤵
- Executes dropped EXE
PID:2108
-