Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe
Resource
win10v2004-20231222-en
General
-
Target
84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe
-
Size
1.4MB
-
MD5
94e40718defafd5637af418cac874351
-
SHA1
b9205c94f582d5cc3f85b4dc58810924a7c682e2
-
SHA256
84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278
-
SHA512
dbff2e9099f74873aeb1483f910e591d22ac645b2cc51514b2be8bc2503735609b8af7f819062347312f6159bfcd6de0e1f51b55dd2278894b7f8d887b4b87e8
-
SSDEEP
24576:37blgC90fdCQUkR2/Z/NpKgC+3L0acsa7H8WtPC3Et5Cc:375CwQRw/Zmgl7razxPpt5Z
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 212 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp -
Loads dropped DLL 5 IoCs
pid Process 212 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp 212 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp 212 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp 212 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp 212 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2092 wrote to memory of 212 2092 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe 87 PID 2092 wrote to memory of 212 2092 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe 87 PID 2092 wrote to memory of 212 2092 84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe"C:\Users\Admin\AppData\Local\Temp\84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\is-AU79R.tmp\84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp"C:\Users\Admin\AppData\Local\Temp\is-AU79R.tmp\84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp" /SL5="$B0060,1176792,57856,C:\Users\Admin\AppData\Local\Temp\84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:212
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
961KB
MD5dff34c7a8c8a9ad07f8b4354964bd346
SHA1223e25a6f49ce20fac1c3b7134acb400c9325b17
SHA256ad15d243f7069cf48f9731cebd4c5f35d60d9819c929def98ada4101ad67130a
SHA512e27bca03e2e63331ed69a1d66ba9f2ca00a4f48b62c2ebfc417b7e7d01c22d16f89a759a3345ca3937156911b3d53332b5184b9174ee752cc44008460146762e
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
200KB
MD5d82a429efd885ca0f324dd92afb6b7b8
SHA186bbdaa15e6fc5c7779ac69c84e53c43c9eb20ea
SHA256b258c4d7d2113dee2168ed7e35568c8e03341e24e3eafc7a22a0d62e32122ef3
SHA5125bf0c3b8fa5db63205a263c4fa5337188173248bef609ba4d03508c50db1fd1e336f3041ce96d78cc97659357a83e6e422f5b079d893a20a683270e05f5438df
-
C:\Users\Admin\AppData\Local\Temp\is-AU79R.tmp\84cf05ace86e985572b5a6d4deeb59c9089ccfb6adf39ccd0d2257409920a278.tmp
Filesize697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49