Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/01/2024, 11:24
Behavioral task
behavioral1
Sample
58cd52f895ae93a4024dd32a25482b10.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
58cd52f895ae93a4024dd32a25482b10.exe
Resource
win10v2004-20231215-en
General
-
Target
58cd52f895ae93a4024dd32a25482b10.exe
-
Size
1.3MB
-
MD5
58cd52f895ae93a4024dd32a25482b10
-
SHA1
a9117f246defd963ddb6cbecfb75a5fc9e266094
-
SHA256
5d2d1e8d5268709daae6f1e88e9900256ddce9e58d6e3d7d7bda9e1b1aa7336f
-
SHA512
1c1a8b4588f15f37f121dec76bf3cfbe05cbbb3f9f5c7ee690cb64ab4ed20c85668b80cba39e65377327e7990aaad8bfd60a5ebd2bbf401b816614debb5c93c6
-
SSDEEP
24576:CMzfb5v+gwitwuMIYuMxbxYRztOMsJyz0ssADg2oVtMxIEigSUCJ7Wc:vw8HYuMxbUzWIDSixIFH1pp
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1632 58cd52f895ae93a4024dd32a25482b10.exe -
Executes dropped EXE 1 IoCs
pid Process 1632 58cd52f895ae93a4024dd32a25482b10.exe -
resource yara_rule behavioral2/memory/376-0-0x0000000000400000-0x00000000008EF000-memory.dmp upx behavioral2/files/0x000400000001e716-11.dat upx behavioral2/memory/1632-13-0x0000000000400000-0x00000000008EF000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 376 58cd52f895ae93a4024dd32a25482b10.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 376 58cd52f895ae93a4024dd32a25482b10.exe 1632 58cd52f895ae93a4024dd32a25482b10.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 376 wrote to memory of 1632 376 58cd52f895ae93a4024dd32a25482b10.exe 88 PID 376 wrote to memory of 1632 376 58cd52f895ae93a4024dd32a25482b10.exe 88 PID 376 wrote to memory of 1632 376 58cd52f895ae93a4024dd32a25482b10.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\58cd52f895ae93a4024dd32a25482b10.exe"C:\Users\Admin\AppData\Local\Temp\58cd52f895ae93a4024dd32a25482b10.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\58cd52f895ae93a4024dd32a25482b10.exeC:\Users\Admin\AppData\Local\Temp\58cd52f895ae93a4024dd32a25482b10.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1632
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD58c4642cc56272ce09db8b97f4d2cce60
SHA1a36f97eebba1c20c0080592723dd420b656a4a64
SHA256b83e0c6cc61b8ed5d257c377950ca9eb813afacd35be47aa0882bc15a71527af
SHA512efe2dd6c0f2258d7d7abb69f189a1f85664c3cdb95696e98e16fe2f3741420431e074baaa72061a5b902cb8d8a345baa55442ddf4896dfe15cbb72a711c78940