Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 12:07
Static task
static1
Behavioral task
behavioral1
Sample
a3bd4747bb8d2e00e078ea2d33f5c050.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a3bd4747bb8d2e00e078ea2d33f5c050.exe
Resource
win10v2004-20240221-en
General
-
Target
a3bd4747bb8d2e00e078ea2d33f5c050.exe
-
Size
385KB
-
MD5
a3bd4747bb8d2e00e078ea2d33f5c050
-
SHA1
4b3c0f64ddef24923e134c5da9c100054dffe262
-
SHA256
8f90021c1de28edf9f7ca578e10656ff634d027bfd3e0c20ff80a705235240ac
-
SHA512
cacabc09a7573b69da7dab804d89e22784fa1ddf69ae4310cfc9c9f02515bd95a0e2269ebe8c499e3ea28920e34ba588a069116a392e47ca9c83249d27fe324d
-
SSDEEP
12288:8pUZjCLRYVRcigimR6oDPNsiDlaZpA0G3YB:8pUZ0RYFgsobGiuA9YB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4240 a3bd4747bb8d2e00e078ea2d33f5c050.exe -
Executes dropped EXE 1 IoCs
pid Process 4240 a3bd4747bb8d2e00e078ea2d33f5c050.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 10 pastebin.com 12 pastebin.com -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1360 a3bd4747bb8d2e00e078ea2d33f5c050.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1360 a3bd4747bb8d2e00e078ea2d33f5c050.exe 4240 a3bd4747bb8d2e00e078ea2d33f5c050.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1360 wrote to memory of 4240 1360 a3bd4747bb8d2e00e078ea2d33f5c050.exe 86 PID 1360 wrote to memory of 4240 1360 a3bd4747bb8d2e00e078ea2d33f5c050.exe 86 PID 1360 wrote to memory of 4240 1360 a3bd4747bb8d2e00e078ea2d33f5c050.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3bd4747bb8d2e00e078ea2d33f5c050.exe"C:\Users\Admin\AppData\Local\Temp\a3bd4747bb8d2e00e078ea2d33f5c050.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\a3bd4747bb8d2e00e078ea2d33f5c050.exeC:\Users\Admin\AppData\Local\Temp\a3bd4747bb8d2e00e078ea2d33f5c050.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4240
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5417ad94df300d2d2e5f27015470f73f8
SHA10250907c7d02ac7c1279477237facf3da2233d7c
SHA2563b43b23d2f7eb0c4de465a4ef794d3af9d3a3f8c16a9573b827ce378131e7fe6
SHA51250a028e386004ad55b795467ec10e01e15b32d160761b2552e2d9b2a1074d8184891d64f7d67df7dbe5db9a4135018eb059fbd5a01af48801ffb9dd609eea614