Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 09:58
Static task
static1
Behavioral task
behavioral1
Sample
770d832b09fbe86e75e16191d89f1639.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
770d832b09fbe86e75e16191d89f1639.exe
Resource
win10v2004-20231215-en
General
-
Target
770d832b09fbe86e75e16191d89f1639.exe
-
Size
293KB
-
MD5
770d832b09fbe86e75e16191d89f1639
-
SHA1
8a437ed91cdb1a4f0a2c7ae4ab3d020574a0b92c
-
SHA256
57a69ca68ccdfd6b2088a8a77b034dde8427328a767feb9705f167b7d7d88e4f
-
SHA512
682cc61e99942a899be7637ac96254232f8d3e579a5e515044225a932ce60d8c9be1fc0a5e098cc367445b72609a615ca9a2fce9eefb999234c9cdee5a4c47e7
-
SSDEEP
6144:TRgym92YGB+40vPLGPAyY8Y4paxrMSK5ply43vNRNByTb7NF31NO:V6fu+40vPH7riL3vNRM91u
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2724 winvnc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3192 wrote to memory of 2724 3192 770d832b09fbe86e75e16191d89f1639.exe 88 PID 3192 wrote to memory of 2724 3192 770d832b09fbe86e75e16191d89f1639.exe 88 PID 3192 wrote to memory of 2724 3192 770d832b09fbe86e75e16191d89f1639.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\770d832b09fbe86e75e16191d89f1639.exe"C:\Users\Admin\AppData\Local\Temp\770d832b09fbe86e75e16191d89f1639.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\7zSDC6.tmp\winvnc.exe.\winvnc.exe2⤵
- Executes dropped EXE
PID:2724
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56ce6e5fcf1a56b80f4ffa6f685d4329d
SHA191780868c241e83754003855407805c0cda20254
SHA2566fcc92e281d25569d300297ef79a5796bc5e0c226aa35624dd6a9f38b8413402
SHA5127af21c8840f56c5ded22161504dd3d6c282ad83a0fb1f711fccfc7d87676de3036120e60e2c0e57fb998a0dcfe512950d3f16e0bdcb493d37a681f31b8cb399f
-
Filesize
1KB
MD57b20cd0ca0646be4c97609c311155bfc
SHA171bd28b696c37bb078cd70d0a19746312800fa69
SHA256c0df4bfc8d8c8cd1729afc62e5fe5c5950551729335c0d289cf9373c3f60bec7
SHA5123bc6719b4b307ee2c1e8c840aa9cdf65fbea01f775b90aa611e7237675db57d4ba4dba716950f2e5846ce87392b142f35dc99b26a1458fed67d05aa707998749
-
Filesize
103KB
MD5280d414001007065748ffcc3d61f91c3
SHA1861d7e29008aa5f9323385aa5e57132f3e33943d
SHA256aadf105f693ac8cec3f5f38c8deefbeb2bded921b43369f5233e4cc233a33b54
SHA51202d21b2be66dc88e49fc8edf9387e231bc6d5baa0ac5319e5a01b1afa985cb2825e9f19fc8580d5f7df75fda77d94e1234c7a5e7d1b1fe8d9f5d4cb27b5a0fd2
-
Filesize
251KB
MD540a21759f5ad164f5c58e3c4c1a30ede
SHA1287b840f6bd10a05922d9ded005eda53128efe12
SHA2565ffb6b4b753e5915516c03f91e6cd09dcfdc87004ce3ecdd2e3e8d51bc0bea72
SHA51219a1052731f8780dac7855454d38685a0e11a898c98c0138c8dcad722f34f9e50f34bbcad5915bf62886942934795d5907e2be081ce84639d415f14aa368db28