Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 07:09
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Hoax.Win32.Agent.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
HEUR-Hoax.Win32.Agent.exe
Resource
win10v2004-20240226-en
General
-
Target
HEUR-Hoax.Win32.Agent.exe
-
Size
74KB
-
MD5
315f656693fa75d0eb56d5da132ef892
-
SHA1
96b7ea4bbb81000293d4a117f9391395ced1e3c2
-
SHA256
186856976bb027537da0f421c1505a84faf5cf5d96734730085da9ea74c9d2f5
-
SHA512
9eae86aa2a06fc76dab491b6f60603b2ced9872915ceca295f0a3c41e2035dc6ade32bef9dd07b49ea5113d7320b1e24b4fb9163aae2e5094235d28955022555
-
SSDEEP
1536:Uj1Tzy48untU8fOMEI3jyYfYiuOjxnCaZ:UhzltUeOsHRJCU
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4644 wrote to memory of 1732 4644 HEUR-Hoax.Win32.Agent.exe 88 PID 4644 wrote to memory of 1732 4644 HEUR-Hoax.Win32.Agent.exe 88 PID 4644 wrote to memory of 1732 4644 HEUR-Hoax.Win32.Agent.exe 88 PID 1732 wrote to memory of 4948 1732 cmd.exe 90 PID 1732 wrote to memory of 4948 1732 cmd.exe 90 PID 1732 wrote to memory of 4948 1732 cmd.exe 90 PID 4948 wrote to memory of 2940 4948 iexpress.exe 92 PID 4948 wrote to memory of 2940 4948 iexpress.exe 92 PID 4948 wrote to memory of 2940 4948 iexpress.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Hoax.Win32.Agent.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Hoax.Win32.Agent.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\636D.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\HEUR-Hoax.Win32.Agent.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:2940
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
74KB
MD54459bb6923f7b579151a85f6366880ba
SHA1f6c36a08d2df946e5024f1aa4356e5cdd5f630e3
SHA256f62285180ff65c4953380c5fe6dcac0be83264f2257e0ef976f0870b099edd4c
SHA512cc6f3c0276d8f58efa4aa0cf445e9025a5a15e324cea088568185f77287a86a7ca94a8168802ebb0596203f656f3ac185cedc6839c19ce7489deaf455bf76e60
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083