Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 01:22
Static task
static1
Behavioral task
behavioral1
Sample
59e7db6ee6b1e23ba61096933d3259f6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
59e7db6ee6b1e23ba61096933d3259f6.exe
Resource
win10v2004-20231222-en
General
-
Target
59e7db6ee6b1e23ba61096933d3259f6.exe
-
Size
771KB
-
MD5
59e7db6ee6b1e23ba61096933d3259f6
-
SHA1
cd13e6ee54f6b103b6590e26684570d41dc13f69
-
SHA256
2cf15190682f5fd41a8974bf97453eed23691cd0266d225dfc1b2a71511f7e7c
-
SHA512
dcc34e81ee1a6e2c3b6bdaf68e938ca9ad8977219e33430a8d1c91cdb4996eabbff21b899f257da79bc05fd7b7562a5f4bfee569c311859e712082de4c7d669f
-
SSDEEP
24576:QFeT0Jd0goX5x4HnRAlVsFD19UtJPZ/b10hJaothZ2/T6FBBB:aeT0XsXD4HnRALsFD19oJPJ/ofT
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1676 59e7db6ee6b1e23ba61096933d3259f6.exe -
Executes dropped EXE 1 IoCs
pid Process 1676 59e7db6ee6b1e23ba61096933d3259f6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1500 59e7db6ee6b1e23ba61096933d3259f6.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1500 59e7db6ee6b1e23ba61096933d3259f6.exe 1676 59e7db6ee6b1e23ba61096933d3259f6.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1676 1500 59e7db6ee6b1e23ba61096933d3259f6.exe 34 PID 1500 wrote to memory of 1676 1500 59e7db6ee6b1e23ba61096933d3259f6.exe 34 PID 1500 wrote to memory of 1676 1500 59e7db6ee6b1e23ba61096933d3259f6.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\59e7db6ee6b1e23ba61096933d3259f6.exe"C:\Users\Admin\AppData\Local\Temp\59e7db6ee6b1e23ba61096933d3259f6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\59e7db6ee6b1e23ba61096933d3259f6.exeC:\Users\Admin\AppData\Local\Temp\59e7db6ee6b1e23ba61096933d3259f6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:1676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307KB
MD5302b023c4111fbf6ff3ae70b82c8fb87
SHA1b624e17f0e1480c2e7ba379f72291b191a0add54
SHA25687f9e1a7e2eb5a6e8a3ee916d01453dcc85dc1304e11229112f33fc6322dd40d
SHA5124c8a55824b4bd569ad39b4170810d13e0f82bd654d35c2ee56d6a18ce35937296c2ea143efab3f0e1cfcbafbd6d306e9f82e952ec62d648c2f2bc1c8010356eb