Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 10:45

General

  • Target

    58b8bb8708a1f5ae86f2f4b95a4b0b5d.exe

  • Size

    2.7MB

  • MD5

    58b8bb8708a1f5ae86f2f4b95a4b0b5d

  • SHA1

    cbefe83b9e62e9efda12989c4e3796d8bcdcf5c5

  • SHA256

    df3b33e6cec4fa8a86bfd8bbab94743322f84a24bd1b0e626c352cb97bc717d2

  • SHA512

    4728c16e09cb8f03aa76e8a0489d29b299eb9430240cd43671d40ba5e8e7e185a08593c7de9988648370582a5af52d9b24b8337aa0213e7a8fb7f8e60b846003

  • SSDEEP

    49152:0rxJB9slWY5T97x4rvXtO+jw4ztk9/FdLQz+V759YTZgl0wVHVN8A:0VOlWY9Sjd1ztgFd0SV759YFg6A

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58b8bb8708a1f5ae86f2f4b95a4b0b5d.exe
    "C:\Users\Admin\AppData\Local\Temp\58b8bb8708a1f5ae86f2f4b95a4b0b5d.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4492
    • C:\Windows\svchost.exe
      "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\58b8bb8708a1f5ae86f2f4b95a4b0b5d.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Users\Admin\AppData\Local\Temp\58b8bb8708a1f5ae86f2f4b95a4b0b5d.exe
        "C:\Users\Admin\AppData\Local\Temp\58b8bb8708a1f5ae86f2f4b95a4b0b5d.exe"
        3⤵
        • Executes dropped EXE
        PID:1928
  • C:\Windows\svchost.exe
    C:\Windows\svchost.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:5032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\58b8bb8708a1f5ae86f2f4b95a4b0b5d.exe

    Filesize

    2.7MB

    MD5

    cde57c7204fd4d791d026cd00b5b4f3c

    SHA1

    be0e417a12914a48cca803d95d00775af03229a9

    SHA256

    0602d4990e62fae8afcdac444f66eabdd3224b0be86f25a0798ac42992be7602

    SHA512

    781170e7396afff18d86277791cb9cead5458cda6f115e2b46e400450fe3ff2d4cc8eeb329b35918db06f46b0d93a133537a486253369f9cc702c53b5250331a

  • C:\Windows\svchost.exe

    Filesize

    35KB

    MD5

    345861f739ef259c33abc7ef49b81694

    SHA1

    3b6aff327d91e66a207c0557eac6ddefab104598

    SHA256

    fc3220611aded768e37b125c4e4d5a8ffdbf7dfa8d8c19c07c7791b486457948

    SHA512

    7b0aae948a594f29125a3e80f6c2b51421cda07f5ee4554538037f12b87d4b3937ee74fb400505efcd2a953c897a49d79d875148516dcef619c514251854dfad

  • memory/4424-10-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/4492-3-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/5032-14-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/5032-16-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/5032-18-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB