Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2024, 06:51

General

  • Target

    a326b68cd2fe65d4afc8332cccbcebe8.exe

  • Size

    385KB

  • MD5

    a326b68cd2fe65d4afc8332cccbcebe8

  • SHA1

    011ecb4892200813d1d90c588956f564b595828f

  • SHA256

    9e9b564f58d8eabc82e5eb3c6bc5e50bd7b1f20982c04b3b71796dd94f958227

  • SHA512

    e7ea29043248a7bdd7c366fca8ee2d1833e80542f065d3cd943ccc07f6fff86b3a5492e3f763945617931cc6252cd2e76a957c629f330938b115ce45d4e75286

  • SSDEEP

    12288:jZFit36GpgyCcdQ1WiD9CiE5TbR1BglCB:9FiqGOyY1D9CrbRvglCB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a326b68cd2fe65d4afc8332cccbcebe8.exe
    "C:\Users\Admin\AppData\Local\Temp\a326b68cd2fe65d4afc8332cccbcebe8.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Users\Admin\AppData\Local\Temp\a326b68cd2fe65d4afc8332cccbcebe8.exe
      C:\Users\Admin\AppData\Local\Temp\a326b68cd2fe65d4afc8332cccbcebe8.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a326b68cd2fe65d4afc8332cccbcebe8.exe

    Filesize

    385KB

    MD5

    f8f8ea04c51a304782115337eda485c4

    SHA1

    0003536e3f01934800e85b3825f2694653078dfe

    SHA256

    6bb17019de6c904bdf6a68bd8cc897afeeccc8dc5927e1d9c9b029165bee7684

    SHA512

    f529de35941a281c1d1c1c2ddbc551d34a3e49d93c5ad2617f75ffa67c3acff7cca627ee3621ab281a1c112efb8e6d7ac4e17c54700f00a12f97d14c006e02dc

  • memory/1580-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/1580-1-0x0000000000190000-0x00000000001F6000-memory.dmp

    Filesize

    408KB

  • memory/1580-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1580-11-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/4464-13-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/4464-15-0x0000000001470000-0x00000000014D6000-memory.dmp

    Filesize

    408KB

  • memory/4464-20-0x0000000001610000-0x000000000166F000-memory.dmp

    Filesize

    380KB

  • memory/4464-21-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/4464-30-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4464-35-0x000000000C640000-0x000000000C67C000-memory.dmp

    Filesize

    240KB

  • memory/4464-36-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB