Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 20:21
Behavioral task
behavioral1
Sample
65f2db5e3b1106f4199e97d27523d014.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
65f2db5e3b1106f4199e97d27523d014.exe
Resource
win10v2004-20231222-en
General
-
Target
65f2db5e3b1106f4199e97d27523d014.exe
-
Size
308KB
-
MD5
65f2db5e3b1106f4199e97d27523d014
-
SHA1
ceab4507d7f3928ae6a16e62e7687ec51e1e7b6b
-
SHA256
7fb42aa046e609fea1e2619140984a2f5b2afd6204505e85608dc9338d20ac3b
-
SHA512
30c662074936490fea111e86f85676e39297063d10dc21a84f13683ffdfd2161a02443b8f5ce25ca480b530b73d5cbc2b7e780eb48b9a3c99f37223bee202141
-
SSDEEP
6144:f60yLW4Z/OiwEdzFduwv/QVXbRfzEesSksOW7vQ6gS5IzVRD3OfoS:f60ya4MEdKNf/sDsOW7vQXS2zVRD3OfZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1548 RAbc.exe -
resource yara_rule behavioral2/memory/5116-0-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/files/0x00070000000231ea-6.dat upx behavioral2/memory/1548-7-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/memory/1548-9-0x0000000000400000-0x00000000004D7000-memory.dmp upx behavioral2/memory/5116-10-0x0000000000400000-0x00000000004D7000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\RAbc.exe 65f2db5e3b1106f4199e97d27523d014.exe File opened for modification C:\Windows\SysWOW64\RAbc.exe RAbc.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 5116 65f2db5e3b1106f4199e97d27523d014.exe 5116 65f2db5e3b1106f4199e97d27523d014.exe 5116 65f2db5e3b1106f4199e97d27523d014.exe 5116 65f2db5e3b1106f4199e97d27523d014.exe 5116 65f2db5e3b1106f4199e97d27523d014.exe 5116 65f2db5e3b1106f4199e97d27523d014.exe 1548 RAbc.exe 1548 RAbc.exe 1548 RAbc.exe 1548 RAbc.exe 1548 RAbc.exe 1548 RAbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65f2db5e3b1106f4199e97d27523d014.exe"C:\Users\Admin\AppData\Local\Temp\65f2db5e3b1106f4199e97d27523d014.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5116
-
C:\Windows\SysWOW64\RAbc.exeC:\Windows\SysWOW64\RAbc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1548
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
308KB
MD565f2db5e3b1106f4199e97d27523d014
SHA1ceab4507d7f3928ae6a16e62e7687ec51e1e7b6b
SHA2567fb42aa046e609fea1e2619140984a2f5b2afd6204505e85608dc9338d20ac3b
SHA51230c662074936490fea111e86f85676e39297063d10dc21a84f13683ffdfd2161a02443b8f5ce25ca480b530b73d5cbc2b7e780eb48b9a3c99f37223bee202141