Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
b5bcf9d796bd46d6c515fff542fa2984.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b5bcf9d796bd46d6c515fff542fa2984.exe
Resource
win10v2004-20240226-en
General
-
Target
b5bcf9d796bd46d6c515fff542fa2984.exe
-
Size
1.9MB
-
MD5
b5bcf9d796bd46d6c515fff542fa2984
-
SHA1
d74d0815c9892db0556e992ee7d0b9ee65a75de5
-
SHA256
d8cc91acd9edb70aa29f20737b546b7d439bbda5ea2552336a334f8f7bcf6d26
-
SHA512
e90cdb9cceb8f7e7f751be708599dd7334375ad6627df92e1d9de80f51915bdef74743f4aa67f2b50fb8eaa599d54b0c973d15ac71c14514603acb8a842199cc
-
SSDEEP
49152:Qoa1taC070druvA2y3jkslkjIhGOVTT2mLR:Qoa1taC0c2oosl86V/2mF
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2752 BA67.tmp -
Executes dropped EXE 1 IoCs
pid Process 2752 BA67.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 388 wrote to memory of 2752 388 b5bcf9d796bd46d6c515fff542fa2984.exe 91 PID 388 wrote to memory of 2752 388 b5bcf9d796bd46d6c515fff542fa2984.exe 91 PID 388 wrote to memory of 2752 388 b5bcf9d796bd46d6c515fff542fa2984.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5bcf9d796bd46d6c515fff542fa2984.exe"C:\Users\Admin\AppData\Local\Temp\b5bcf9d796bd46d6c515fff542fa2984.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp" --splashC:\Users\Admin\AppData\Local\Temp\b5bcf9d796bd46d6c515fff542fa2984.exe EF0F518B8231E9D4E9C01650AE49D911FEB8D4D409D4190BB0AC906292F7176792A63773D054AA705B4C6E3EE57440CDA55BCCF45424D1EB94A44447663ABAFE2⤵
- Deletes itself
- Executes dropped EXE
PID:2752
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD523481a9456060dbd227816806cb4385a
SHA1a4adffbf2ad8b6f1d5a57c2fa073688371662541
SHA256f7070b05be921f7666f3150ed65489f7916ce89bd01f2811dcc684772aa8140d
SHA51207cf1340be60ebcc2ae120ec77cd7084647b3a5745654671928359edb7fa8ab5d25b023b54fdd44bb32bad74dd4ec24a13421d3abd46efae58fbfb1fe9a44bf3