Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 10:19
Static task
static1
Behavioral task
behavioral1
Sample
992af39606e42e4e27656416217cface.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
992af39606e42e4e27656416217cface.exe
Resource
win10v2004-20231222-en
General
-
Target
992af39606e42e4e27656416217cface.exe
-
Size
1.1MB
-
MD5
992af39606e42e4e27656416217cface
-
SHA1
4fd6dba1e514d3572649de427cef6ea23068a33d
-
SHA256
49a4495baa65855a68d32fd5fc980147c47899a09c3b1d964055e1e4ad82afc1
-
SHA512
62d38bcdf01c667351fd73b0841ad6d9b473199da7a617cf6129476aef3707c15f396278372b149c4935b0c18e1fb5a787dfdd55daaa46984acdbc2c66e6c86a
-
SSDEEP
24576:7zXKqa8SEijjC+37liXbLbklmfB6/tbQdSmKBQXj3Ly:7z6qaakjC+3srLAKB61bQd3KaXb+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2656 tl.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\aeyxrine\tl.exe 992af39606e42e4e27656416217cface.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4308 wrote to memory of 2656 4308 992af39606e42e4e27656416217cface.exe 83 PID 4308 wrote to memory of 2656 4308 992af39606e42e4e27656416217cface.exe 83 PID 4308 wrote to memory of 2656 4308 992af39606e42e4e27656416217cface.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\992af39606e42e4e27656416217cface.exe"C:\Users\Admin\AppData\Local\Temp\992af39606e42e4e27656416217cface.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Program Files (x86)\aeyxrine\tl.exe"C:\Program Files (x86)\aeyxrine\tl.exe"2⤵
- Executes dropped EXE
PID:2656
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD537838c32da9f5768a8765f1166714c97
SHA1df4608e931767667b7fbf1c7961e8f5625cbb597
SHA256c5b0b5af03b832955b833c70b62f19985536263f9c89cbd7bafb17d6b5d090ab
SHA512202900604c1685338afedc35db668b8a9fe2d9bcf436a4f3e91f96969bdc2a883f714ec1d74da48bf1f846cc287b1c161e3ebfd0322febd996d44a465e721508