Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
743c4293924966145a15247019678041.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
743c4293924966145a15247019678041.exe
Resource
win10v2004-20231215-en
General
-
Target
743c4293924966145a15247019678041.exe
-
Size
4.8MB
-
MD5
743c4293924966145a15247019678041
-
SHA1
ab5cd9f4c3818b44ec13c3003ab024365b439d7d
-
SHA256
504c149e8c6eec8df5921e3985f4c39905c672e99934ed647297a36a46738689
-
SHA512
97159de873a712b016cbb40b97c27168edc40c9ae899afdf207ebd595fa219703818837e2e0d8627dc1164b37312d87b396f15774860e87d6542369c6dde4f37
-
SSDEEP
98304:PX4uRbJiH9PqGVGOobrS+S8Qu+4warOauQ4KS/f41WvdYvzyUyazx14:vXRWPqGVYi8QuRORKS/hvdYyUya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3136 743c4293924966145a15247019678041.tmp 2284 Minima.exe -
Loads dropped DLL 1 IoCs
pid Process 3136 743c4293924966145a15247019678041.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 18 IoCs
description ioc Process File created C:\Program Files (x86)\Corrupti\is-0DNV6.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\aut\is-RR0VQ.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\aut\is-PQMR9.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\aut\is-JV88L.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\unins000.dat 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\is-3S3RP.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\is-93Q1A.tmp 743c4293924966145a15247019678041.tmp File opened for modification C:\Program Files (x86)\Corrupti\rerum\sqlite3.dll 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\rerum\is-AUOM6.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\rerum\is-5HCE5.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\rerum\is-AJVB8.tmp 743c4293924966145a15247019678041.tmp File opened for modification C:\Program Files (x86)\Corrupti\rerum\Minima.exe 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\is-55CGH.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\aut\is-TBNTP.tmp 743c4293924966145a15247019678041.tmp File opened for modification C:\Program Files (x86)\Corrupti\unins000.dat 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\rerum\is-E9MMT.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\rerum\is-B4FKD.tmp 743c4293924966145a15247019678041.tmp File created C:\Program Files (x86)\Corrupti\rerum\is-AS8O6.tmp 743c4293924966145a15247019678041.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3136 743c4293924966145a15247019678041.tmp 3136 743c4293924966145a15247019678041.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3136 743c4293924966145a15247019678041.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3420 wrote to memory of 3136 3420 743c4293924966145a15247019678041.exe 87 PID 3420 wrote to memory of 3136 3420 743c4293924966145a15247019678041.exe 87 PID 3420 wrote to memory of 3136 3420 743c4293924966145a15247019678041.exe 87 PID 3136 wrote to memory of 2284 3136 743c4293924966145a15247019678041.tmp 90 PID 3136 wrote to memory of 2284 3136 743c4293924966145a15247019678041.tmp 90 PID 3136 wrote to memory of 2284 3136 743c4293924966145a15247019678041.tmp 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\743c4293924966145a15247019678041.exe"C:\Users\Admin\AppData\Local\Temp\743c4293924966145a15247019678041.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\is-UQSJ2.tmp\743c4293924966145a15247019678041.tmp"C:\Users\Admin\AppData\Local\Temp\is-UQSJ2.tmp\743c4293924966145a15247019678041.tmp" /SL5="$10006A,4319728,721408,C:\Users\Admin\AppData\Local\Temp\743c4293924966145a15247019678041.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Program Files (x86)\Corrupti\rerum\Minima.exe"C:\Program Files (x86)\Corrupti/\rerum\Minima.exe" d33ea9aeaf55fd261c3afe4927f1bef53⤵
- Executes dropped EXE
PID:2284
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD58df579fe5002c100ac47dfa49c77639a
SHA13620586debc32712956ca8ab48f8d476f612608b
SHA2563c4ba8d4451b0ddae13db3c76ed52062825bd6dabf1959212c694f9b83300604
SHA512fb2b92be311cf8f50eac0cc7b2dc656a35e5f82a00eaddce1ef3c38901aa49ccb1b96aabe03c2fdbed6195970649364c6f1c773933b66dcd41631aeb63fb73e1
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
2.4MB
MD53fddfbaa9d029821152e746edbabf7ce
SHA1703690b3a2377047f6755e9b5274d608791b8062
SHA256787cef456bd60075199c04ac38dd5e65291bd3a930b132538889e4dafb76fa1a
SHA512fd50e763c6523022f1be02a6a690d2a2dec4e9a73c941314b4a810bbd7605d4058c5c49c53dcbdd8fde5e6c4d2c78fcec52b5bca087cbf552bc1ce90819c4903