Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 08:40

General

  • Target

    743c4293924966145a15247019678041.exe

  • Size

    4.8MB

  • MD5

    743c4293924966145a15247019678041

  • SHA1

    ab5cd9f4c3818b44ec13c3003ab024365b439d7d

  • SHA256

    504c149e8c6eec8df5921e3985f4c39905c672e99934ed647297a36a46738689

  • SHA512

    97159de873a712b016cbb40b97c27168edc40c9ae899afdf207ebd595fa219703818837e2e0d8627dc1164b37312d87b396f15774860e87d6542369c6dde4f37

  • SSDEEP

    98304:PX4uRbJiH9PqGVGOobrS+S8Qu+4warOauQ4KS/f41WvdYvzyUyazx14:vXRWPqGVYi8QuRORKS/hvdYyUya0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\743c4293924966145a15247019678041.exe
    "C:\Users\Admin\AppData\Local\Temp\743c4293924966145a15247019678041.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Local\Temp\is-UQSJ2.tmp\743c4293924966145a15247019678041.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UQSJ2.tmp\743c4293924966145a15247019678041.tmp" /SL5="$10006A,4319728,721408,C:\Users\Admin\AppData\Local\Temp\743c4293924966145a15247019678041.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3136
      • C:\Program Files (x86)\Corrupti\rerum\Minima.exe
        "C:\Program Files (x86)\Corrupti/\rerum\Minima.exe" d33ea9aeaf55fd261c3afe4927f1bef5
        3⤵
        • Executes dropped EXE
        PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Corrupti\rerum\Minima.exe

    Filesize

    4.6MB

    MD5

    8df579fe5002c100ac47dfa49c77639a

    SHA1

    3620586debc32712956ca8ab48f8d476f612608b

    SHA256

    3c4ba8d4451b0ddae13db3c76ed52062825bd6dabf1959212c694f9b83300604

    SHA512

    fb2b92be311cf8f50eac0cc7b2dc656a35e5f82a00eaddce1ef3c38901aa49ccb1b96aabe03c2fdbed6195970649364c6f1c773933b66dcd41631aeb63fb73e1

  • C:\Users\Admin\AppData\Local\Temp\is-CR50N.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • C:\Users\Admin\AppData\Local\Temp\is-UQSJ2.tmp\743c4293924966145a15247019678041.tmp

    Filesize

    2.4MB

    MD5

    3fddfbaa9d029821152e746edbabf7ce

    SHA1

    703690b3a2377047f6755e9b5274d608791b8062

    SHA256

    787cef456bd60075199c04ac38dd5e65291bd3a930b132538889e4dafb76fa1a

    SHA512

    fd50e763c6523022f1be02a6a690d2a2dec4e9a73c941314b4a810bbd7605d4058c5c49c53dcbdd8fde5e6c4d2c78fcec52b5bca087cbf552bc1ce90819c4903

  • memory/2284-48-0x0000000000400000-0x00000000016AC000-memory.dmp

    Filesize

    18.7MB

  • memory/2284-88-0x0000000000400000-0x00000000016AC000-memory.dmp

    Filesize

    18.7MB

  • memory/2284-73-0x0000000000400000-0x00000000016AC000-memory.dmp

    Filesize

    18.7MB

  • memory/2284-43-0x0000000000400000-0x00000000016AC000-memory.dmp

    Filesize

    18.7MB

  • memory/2284-44-0x0000000000400000-0x00000000016AC000-memory.dmp

    Filesize

    18.7MB

  • memory/2284-45-0x00000000044E0000-0x00000000044E1000-memory.dmp

    Filesize

    4KB

  • memory/3136-6-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB

  • memory/3136-47-0x0000000000400000-0x0000000000679000-memory.dmp

    Filesize

    2.5MB

  • memory/3136-51-0x0000000000780000-0x0000000000781000-memory.dmp

    Filesize

    4KB

  • memory/3420-46-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/3420-0-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB

  • memory/3420-2-0x0000000000400000-0x00000000004BE000-memory.dmp

    Filesize

    760KB