Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/02/2024, 02:38

General

  • Target

    88559e34bef2095e07c56426e3421395.exe

  • Size

    192KB

  • MD5

    88559e34bef2095e07c56426e3421395

  • SHA1

    8789a395de5270e18b11f46448e99d4cbd2d2b94

  • SHA256

    d60e5ca6eeb2192106beb658d64f7feaa07e2bab339dfd7dd08de114c2d42067

  • SHA512

    cbf505a080c397561d1b9d39cd692f145a9d25e993577dcd6fe64cc88ad7d2c3d756a48f3080cdb2d3d406269cc18482c8b629907cebe3b241e8e0f9be3fd93a

  • SSDEEP

    3072:LaVEAooXUK9AKYkk4/1V15JobX6oklBu+hSPNBz+uTUNO+3akX72WMRDP6GPtCzs:+aAhl10bX6okCOSPzjCP72TD60czB

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies registry class 5 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe
    "C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\fnous.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2444
      • C:\Windows\SysWOW64\regedit.exe
        regedit /s C:\Users\Admin\AppData\Local\Temp\nothks.reg
        3⤵
        • Modifies registry class
        • Runs .reg file with regedit
        PID:1064
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c erase /F "C:\Users\Admin\AppData\Local\Temp\88559e34bef2095e07c56426e3421395.exe"
      2⤵
        PID:816

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\fnous.bat

      Filesize

      126B

      MD5

      7ab275c1bc8750fe49119429e12ab856

      SHA1

      ea556c59c5d3f2be584d2e208ba42a1540f46986

      SHA256

      8d96bacc0e4651d7b8c27613f3f721bb89ca9fb9430bab66b2ef90bfe8cb5bb3

      SHA512

      7fe4bce942523a6adde6d83fc2f63302283f3e0642db4f9f650d50ba8f6f2b7b587229736521615d54b596f24a23146ab7aecb512c145b8dc4b81050ac3576c1

    • C:\Users\Admin\AppData\Local\Temp\nothks.reg

      Filesize

      403B

      MD5

      e1db5e72383ca2535cc04d98efb0f6e6

      SHA1

      b3407d394658ad2d4ef59179fd2ddd419a1dc1d7

      SHA256

      52a9ba0c766a4da941eb674797f1770712e64e2d2104271b4ff6368a45ba5c31

      SHA512

      6ac5c144d0103b722a7203b04f79b3c691ff1393b59555a7ccd454a10a64e2c60111e9e45dc1fdaa3fdf180fac2b0416250aa0180a946c772bd3f1225c15c095

    • memory/1856-0-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/1856-1-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/1856-2-0x00000000001C0000-0x00000000001C2000-memory.dmp

      Filesize

      8KB

    • memory/1856-8-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB