Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe
Resource
win10v2004-20240226-en
General
-
Target
084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe
-
Size
819KB
-
MD5
5a8e1724bea3fbc05af3d5b3619f527e
-
SHA1
b702dea37a8f977e2d946c311c89bef59a6e67a6
-
SHA256
084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945
-
SHA512
c6820a4a32a5689fc769865d0deb3cba2d358f13a543b0d29fe0d31db563a7aa84f8afde7b6d419cf1e699b5ee2044bea89312baa169583c8dbec8bd26fbc158
-
SSDEEP
24576:Kui4rB93oPp+E8YvaKR97cmYvaKRqCr9HldAHJ:xPn3oPp+E8Yv53cmYv5nrdAH
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4744 5EF8.tmp -
Executes dropped EXE 1 IoCs
pid Process 4744 5EF8.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4744 4940 084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe 86 PID 4940 wrote to memory of 4744 4940 084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe 86 PID 4940 wrote to memory of 4744 4940 084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe"C:\Users\Admin\AppData\Local\Temp\084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\084f9ba4c047668690fdcaf1d9518d77454e8653cb3d6ab5b9407acc5755d945.exe 87333B9BED7FF0BDA910AE78FA55DFB0EADE09FD8124C33D7794990F38DEE52AD6E022633CDB20D4CF77F2D6706D59D804E5F9B049B447584CF2DA75DD5C27712⤵
- Deletes itself
- Executes dropped EXE
PID:4744
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
819KB
MD5035809fa16acfb83ae554240f7f96de5
SHA1b6e33746acf8cde0f067b343afdf77bd1fc77f63
SHA256170710db8efa4239f5ea1ffca3d5b5401435df703aa931af4a8e15490769b9ba
SHA512401e6369b34b79f4559716bb82df43a3e6a1174838361f5bfa682eea60881b1bf92334d188b929f62c35c4107d21342ba7238b4955f9d52eae063ed1403694e4