Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 21:34
Static task
static1
Behavioral task
behavioral1
Sample
a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
Resource
win10v2004-20231215-en
General
-
Target
a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe
-
Size
73KB
-
MD5
c54181aab1a2fe0fc4d1035a81f21597
-
SHA1
f07695831b6e973359a71d1827e0554590bfc298
-
SHA256
a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee
-
SHA512
ef7fbafb12e3dce81b76ab53bd80e535bb8ae3bdf0b9087837b2c6705cc888f901ef51adf7dc81e93a6c73905968e0b35e8d4c619aee167e3b85d53643cd7320
-
SSDEEP
1536:hb/uojkcN6Lb/J5RhwK5QPqfhVWbdsmA+RjPFLC+e5hg0ZGUGf2g:hDuojk7MNPqfcxA+HFshgOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2824 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4160 wrote to memory of 4856 4160 a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe 86 PID 4160 wrote to memory of 4856 4160 a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe 86 PID 4160 wrote to memory of 4856 4160 a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe 86 PID 4856 wrote to memory of 2824 4856 cmd.exe 87 PID 4856 wrote to memory of 2824 4856 cmd.exe 87 PID 4856 wrote to memory of 2824 4856 cmd.exe 87 PID 2824 wrote to memory of 2420 2824 [email protected] 88 PID 2824 wrote to memory of 2420 2824 [email protected] 88 PID 2824 wrote to memory of 2420 2824 [email protected] 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe"C:\Users\Admin\AppData\Local\Temp\a02408e7fdcfb06e253388d4b2698c200e3a16a8278183dafe47fe638fb787ee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\cmd.exePID:4856
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:2824
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 15225.exe4⤵PID:2420
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD51102ed868651f3bbc9843a942c68406b
SHA1d8e659f11f681a557ad875e3b845fac7b3d7be3e
SHA256e37a226b665edb953908ccba0248486bcfad3ccb81ea2c5ea0efa27de3cc36ae
SHA51232552f7fe905c5f0c9c2584bdf372566aaa10640cde0f2e67a7887930e4ff8cd0952d5b3e949b6a722bbdbe44e38f9c8fa691f7c272f35a803f1cc7e05ee939c
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1