Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
2s -
max time network
8s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
962f5ac66fae1f8f1fc2af2f1df7aca9.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
962f5ac66fae1f8f1fc2af2f1df7aca9.exe
Resource
win10v2004-20231215-en
General
-
Target
962f5ac66fae1f8f1fc2af2f1df7aca9.exe
-
Size
2.3MB
-
MD5
962f5ac66fae1f8f1fc2af2f1df7aca9
-
SHA1
3057a2680c6217ff568012481b4b2dc70faf8f60
-
SHA256
d06d958f07a54daadd1268fabee77c9f6d68812ada05963bd2532f4622832e92
-
SHA512
c4ec61211b0ba0049ab011343687e0726a024bf0f3134a1b6ab1a045c5c2a639293a67933c327a2da7298682840876821f102dbca55c1d1d1326e4e002094ace
-
SSDEEP
49152:EQFRHrmQG+yrPrmQG+K+yrPrwrPrmQG+KKrPx:EcK+/e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 736 idtxeh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4848 wrote to memory of 736 4848 962f5ac66fae1f8f1fc2af2f1df7aca9.exe 84 PID 4848 wrote to memory of 736 4848 962f5ac66fae1f8f1fc2af2f1df7aca9.exe 84 PID 4848 wrote to memory of 736 4848 962f5ac66fae1f8f1fc2af2f1df7aca9.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\962f5ac66fae1f8f1fc2af2f1df7aca9.exe"C:\Users\Admin\AppData\Local\Temp\962f5ac66fae1f8f1fc2af2f1df7aca9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\idtxeh.exeC:\Users\Admin\AppData\Local\Temp\idtxeh.exe -run C:\Users\Admin\AppData\Local\Temp\962f5ac66fae1f8f1fc2af2f1df7aca9.exe2⤵
- Executes dropped EXE
PID:736
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD553b26634890b12aa8d2f4fb170944439
SHA17a51688769caa8ed5fa9d926464facf616822e26
SHA256a769b745291804e4adf9a7033fbc3464da5f838164db6e7d1438b177e292a114
SHA512c0cae77c6fd13020c2c2b5cbada8390372b3ac6f62af013be13306f1a81a151aa58f820f89941db82f83fd95a0ab7208416f94e8079eadd608f26e6a708331ef
-
Filesize
385KB
MD54463692fa119e59e295d553650d34328
SHA1a2ca9f9330e2b45e1775e232c8a51210fa66f778
SHA2567fac989a8a4a9c1a72672c9c33e6e394a568c637cc3158425dcd655d62a39c34
SHA5123029becb11b77e7b16bcc588f23fd16e444f970554a99186ceecf87cab6157ce92b7a91d44c9a43bd9ce493d1e27a888f9ee4f8ea5521d4f7b4eb595156607ba