Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
655c92c1d009d72803fb66f5c03d70a2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
655c92c1d009d72803fb66f5c03d70a2.exe
Resource
win10v2004-20231215-en
General
-
Target
655c92c1d009d72803fb66f5c03d70a2.exe
-
Size
2.3MB
-
MD5
655c92c1d009d72803fb66f5c03d70a2
-
SHA1
de9aa234985e13190fce487d3f047f43179411f5
-
SHA256
051e2bfa89d4dc3a7811d17bcac048cbc764020dc52c5645bc5021d740ef0fb4
-
SHA512
d370548ca102a898276dbbb05bf7595dd7ee09b56edd87d1e5f127f018f710dcc4483de74d8020af0aa0d344b6e170be8e4a412047f9821023724ba630d76ad6
-
SSDEEP
49152:NqSHvOJD8IfSEtYNHXm2vgfMkk6w/swJhj8ebA5rOYiZnr:YLelaYYP+RJhAebSivZnr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1724 655c92c1d009d72803fb66f5c03d70a2.tmp -
Loads dropped DLL 2 IoCs
pid Process 1724 655c92c1d009d72803fb66f5c03d70a2.tmp 1724 655c92c1d009d72803fb66f5c03d70a2.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1724 655c92c1d009d72803fb66f5c03d70a2.tmp 1724 655c92c1d009d72803fb66f5c03d70a2.tmp 1724 655c92c1d009d72803fb66f5c03d70a2.tmp 1724 655c92c1d009d72803fb66f5c03d70a2.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1968 wrote to memory of 1724 1968 655c92c1d009d72803fb66f5c03d70a2.exe 87 PID 1968 wrote to memory of 1724 1968 655c92c1d009d72803fb66f5c03d70a2.exe 87 PID 1968 wrote to memory of 1724 1968 655c92c1d009d72803fb66f5c03d70a2.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\655c92c1d009d72803fb66f5c03d70a2.exe"C:\Users\Admin\AppData\Local\Temp\655c92c1d009d72803fb66f5c03d70a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\is-MNTD3.tmp\655c92c1d009d72803fb66f5c03d70a2.tmp"C:\Users\Admin\AppData\Local\Temp\is-MNTD3.tmp\655c92c1d009d72803fb66f5c03d70a2.tmp" /SL5="$A0056,1736876,70144,C:\Users\Admin\AppData\Local\Temp\655c92c1d009d72803fb66f5c03d70a2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1724
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183KB
MD5db25dfdd4c1f2b65c68a230881072695
SHA194cd6a3438041f0e61b0a1bea7b66461854efe69
SHA2561b66aaf1e7e3c493dd96af3b7442ea60072f6e93ba45281eacd31a14ca7e7e73
SHA512db69e4ab2218856e5184d9094e7e39705b83e3efdc15225067205c8faf6e5836145364f1d509192defa3b48864e72b9f8c0f2dc53a7adb2b86c655318b7afc2c
-
Filesize
44B
MD5176f5cbf0529c770f43dec8ca48c075f
SHA112cabe53c896c4f0b49c8a65b9c823e2e748314f
SHA25671e99ac4087d08ccacf8fcfe8a3103d5f8b2cc8b871accdd927eb7d8d00c7893
SHA512db2e2a859c88d62464759711070d3e1197ac1a7ef83fc1bf962b2ce170c49cc33580b8cd99726852d0744601343fc90a4d2d71427f80b2f50429994ec2955961
-
Filesize
164B
MD5adc799ec79eeaef366ea4dddf099c3ae
SHA1556c915615a34a2499604b7b732ab304b20fdd4e
SHA2567e7f18c73560f9c020abe1ab1f22705083281e2ea16ab0030fc927901b5b5d1e
SHA51276962a17cc26d3f9886828be4e43373ac530165e1c627272ed7c0bc731133e97608e55d2e31f44592aad0d0974352155f41a0718aa0666ec128406b1050c1d6c
-
Filesize
1.2MB
MD5e7106fbf42fbc6d5b08a18ada4f781b4
SHA136d4a629f79d772c0b0df8bd2ae2ea09108d239d
SHA25664e1f1fa7d91920b17bc7bc679a4cd8d87ff5b104318b6921bb6bf6a19055635
SHA512adf876296a952aadeb4f25211c0939bf5a278809b5d3007ad7e26c5d4975e7684d242c1b3de796efd474a47cb7ecdb80f9047935924a1108bf0e4d7c973d1845