Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2024, 07:52
Static task
static1
Behavioral task
behavioral1
Sample
7c90de99d5d2411b057ed47de247cbc7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7c90de99d5d2411b057ed47de247cbc7.exe
Resource
win10v2004-20231215-en
General
-
Target
7c90de99d5d2411b057ed47de247cbc7.exe
-
Size
2.7MB
-
MD5
7c90de99d5d2411b057ed47de247cbc7
-
SHA1
47118089438fcb8cc7f1484d416357c3a657feea
-
SHA256
694e6e3e36015ef4215eb6ec910f0ef6585177294896ede7c9530b669e650605
-
SHA512
7e209336aa24c33077abd32a5ddf33bd70036ac383b25146c0702195b6737909b40bd385d530874149e52c19453c09a5be4bdfe5deb3c8a3663da24c92541e28
-
SSDEEP
49152:3U5DRfniMLZmgANK/JXwG6VbgQEHJWU3pI5lxJhkWLl+Gs3olXXGblqnLSKhj0K:k5t0I/VwDV0B3CLl+GsAalqLxj9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2216 7c90de99d5d2411b057ed47de247cbc7.tmp -
Loads dropped DLL 3 IoCs
pid Process 2216 7c90de99d5d2411b057ed47de247cbc7.tmp 2216 7c90de99d5d2411b057ed47de247cbc7.tmp 2216 7c90de99d5d2411b057ed47de247cbc7.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1944 wrote to memory of 2216 1944 7c90de99d5d2411b057ed47de247cbc7.exe 90 PID 1944 wrote to memory of 2216 1944 7c90de99d5d2411b057ed47de247cbc7.exe 90 PID 1944 wrote to memory of 2216 1944 7c90de99d5d2411b057ed47de247cbc7.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c90de99d5d2411b057ed47de247cbc7.exe"C:\Users\Admin\AppData\Local\Temp\7c90de99d5d2411b057ed47de247cbc7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\is-SH0TG.tmp\7c90de99d5d2411b057ed47de247cbc7.tmp"C:\Users\Admin\AppData\Local\Temp\is-SH0TG.tmp\7c90de99d5d2411b057ed47de247cbc7.tmp" /SL5="$D00DE,2446194,121344,C:\Users\Admin\AppData\Local\Temp\7c90de99d5d2411b057ed47de247cbc7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD555c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c