Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
901d946782b7cdcca330975a6729b6ca.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
901d946782b7cdcca330975a6729b6ca.exe
Resource
win10v2004-20231222-en
General
-
Target
901d946782b7cdcca330975a6729b6ca.exe
-
Size
325KB
-
MD5
901d946782b7cdcca330975a6729b6ca
-
SHA1
1316a5bfce6e0fe11ca479cf15313d3ffdd8230e
-
SHA256
11b160985512a52e0370df2e033ee365624938201c0a0c9ec43b18c1feb58c2e
-
SHA512
d81aa5b1696fd5988932571ba78bc79d0f5a526f680ae5501ff876141c9309d5123f2abfcb91346635bf685c4c9848c45174141ce702b11b0443ee3b6d8f0b90
-
SSDEEP
6144:Er1Bh9uEo2S1YnQmCX492DkwNP3qpYFDcYgQUskKWeFCEQOiCYOqmO5oe:Er1B3u6/eIo4ArVUBQCCYOqmO5oe
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 1760 901d946782b7cdcca330975a6729b6ca.exe 1760 901d946782b7cdcca330975a6729b6ca.exe 1760 901d946782b7cdcca330975a6729b6ca.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 901d946782b7cdcca330975a6729b6ca.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum 901d946782b7cdcca330975a6729b6ca.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1760 901d946782b7cdcca330975a6729b6ca.exe 1760 901d946782b7cdcca330975a6729b6ca.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1760 wrote to memory of 636 1760 901d946782b7cdcca330975a6729b6ca.exe 90 PID 1760 wrote to memory of 636 1760 901d946782b7cdcca330975a6729b6ca.exe 90 PID 1760 wrote to memory of 636 1760 901d946782b7cdcca330975a6729b6ca.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe"C:\Users\Admin\AppData\Local\Temp\901d946782b7cdcca330975a6729b6ca.exe"1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\_tin9F8B.bat"2⤵PID:636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
816B
MD5d8a90b37695439df951afb8436576bb6
SHA10a036568e78a2926231f94bb7b4e8f4ef83d3c2a
SHA256f05ea018cd8245008e6e1919d8005900bbbbd393c3b4aeb512c7ceb65cf00596
SHA512aa9b76d76ebb7225188fd24de3f8496bcac526a138a823029430dd3035ada0b7ab177ec6cffd5a84c62adbb3bd7971e95f8e9d79099d5781de6073197644f7fe
-
Filesize
269KB
MD5af7ce801c8471c5cd19b366333c153c4
SHA14267749d020a362edbd25434ad65f98b073581f1
SHA256cf7e00ba429bc9f27ccfacc49ae367054f40ada6cede9f513cc29a24e88bf49e
SHA51288655bd940e9b540c4df551fe68135793eceed03f94389b0654637a18b252bf4d3ef73b0c49548b5fa6ba2cf6d9aff79335c4ebcc0b668e008bcc62c40d2a73c
-
Filesize
71KB
MD528a32444423a357e1ea508f18eb8ad98
SHA1cce5bdd9ca925e853100e599900f657b5f132935
SHA256f35e10a4e568be0e2a13f1e6ca65b942db87e218e4e59162bf503a80b7b8c238
SHA512e8605f4d414fa47011b555c536640156a224e033d9c8a671a2fcbbd12415d15ccc2c65bdf7cc7fe0ae712697540838f2f91433adba11bf81beeff4bf5416b2f0
-
Filesize
50B
MD53a82f05bab461304cb35e60a12838356
SHA12eb83c311edc3c6504eb87e6aa1a17473fdad0d0
SHA25680d89a51e19c752925887d4d6d01db3be70fb6f53b1e8a2fd0f6c5e94d0229d8
SHA5122a9ba3fc2a4b51f03e88693c55cbee3848c9e03b1b0a08056d2afdecad71d47431593fb9c7925360aeab46ef6adc1aded085c94da8c3f9798209d03f4d678226
-
Filesize
91KB
MD5736682c6d96bb1edc84e77041faae33d
SHA1f8f6e20cd2aa23010b85ea289c3bc3cbdbc9ae26
SHA25654346f2e36bdb512ef4f7d702f18e59a746f0b936786bc76a30e87de0a061f17
SHA512fe24353f0f4acafbde7d8cec7a5078668f5e6cd0b06c3e0c96cb3fed0beb3c8af2becb1d97fcbb369ac38193827c8d8a440694c79b5da3180224377e38f53777
-
Filesize
64KB
MD5e81c89ca6a8b6ad10e9e98050a0fb166
SHA1af5f33aaf8cc222296d492c8298537215741465e
SHA2567fe2634832a2fc0927833dabc2cb644f69ed5b2295c472104d83b6bfffcf9ee4
SHA51238d7b844c421e49bde4bf90e5e9baace4779c073beff13ffc9100e9243045edb1f26f61c30dd386d1c04357c2b13afefea51a94c5367b978a0b3bbde3848a91b
-
Filesize
2KB
MD5cb45f741900f51ed947f0c8061884c9f
SHA13c63ff4c2039094b8e86ae28d17968563061f62f
SHA2566f1bd3c9e1ad5ed8b04a016ab26252627c47e527a75925080828db051387f3d5
SHA512d42b62f1ad800968e19dcdd00658cd77c6106e740456b193d08141af974cf8e6f59c9551489922e160ae23a84e39d2132150fee8cf3a663d0db35516af957000
-
Filesize
6KB
MD576153c81683a5373fb0a52062ed60ad6
SHA139677d40e8dd22ff36d8dbdd9b91df7c34e63c76
SHA2561674ef5c096809f3b68293dcb7b0351d6da630d704bb586743320ba729f9518d
SHA512ef025bf4cf28000d862a10e727325f721031b1f626e513da6051d076c5cc56aac8ff3a8da5ba6ba423919ac74f12efc4d25c17812e2ab5a9050b02293a093db3
-
Filesize
14KB
MD51623bb0c615eaeed406a3253a606e71c
SHA1e86516e730bdd2a6d0423211f236f4ae9dd4282e
SHA25667664b6561b8bf32091bca59db37a8c8099da01236accfa85f1367bdcb5f0904
SHA5122d854d2732d9562acfe01350fbeb0b78339d01630f114f8c5f95f7542fff2af93393b5c4f977d9602d78dbea23bf41f2f1a9b0252e51a66971facf208803ec5d
-
Filesize
180KB
MD5a475792794328d8a503568cbe38e8531
SHA147e5c4857f272898ed515e939f92cb9243b2ce2e
SHA2562cd6c67a711059c2245615d80ee0e7d44a003b66d5577513b1dfb1bd7f1e7312
SHA5123ea14ace569233dd69e730b4dfae4f1292d2e950aa26aceeae78715d0831ff6919d1bbf7c70ec256dd8a5db7f2d09ea4f29a564c125b54fdf8c7de2c78631184
-
Filesize
83KB
MD5777cc822788b972e25228237cca062c4
SHA1427060ba85dd05064cf2c8233881ca2e5f3357f3
SHA256fc053ed24a1e006ad027454b467358ca5f043b3b485801bbe5bd5b8c57a15c9e
SHA51230e02511f3b93eec37d8d97ca5a3fb744817fc6d048c52f4376984846410b7c42a06f7e70949b4c1602cdb50507eafe6f76ca3583f1063bebc3de7f53e710536