Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 00:03
Static task
static1
Behavioral task
behavioral1
Sample
90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe
Resource
win10v2004-20231215-en
General
-
Target
90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe
-
Size
73KB
-
MD5
8110775f52b855290b0a9207899fda17
-
SHA1
24e3090532b8e091e0fed048010b3ffbed5a28ce
-
SHA256
90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d
-
SHA512
6b698fe034374f9ebd0d5bba7efc73f439bab75eddbf840629face9da7dd0d2698ffa7d9f68da5434cf79a9a219be385cc1c819972bbe51c47b60ee954dce816
-
SSDEEP
1536:hblJihw6Fovqos7K5QPqfhVWbdsmA+RjPFLC+e5hNT0ZGUGf2g:h76S9s7NPqfcxA+HFshFOg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4280 [email protected] -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2144 wrote to memory of 4152 2144 90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe 86 PID 2144 wrote to memory of 4152 2144 90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe 86 PID 2144 wrote to memory of 4152 2144 90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe 86 PID 4152 wrote to memory of 4280 4152 cmd.exe 87 PID 4152 wrote to memory of 4280 4152 cmd.exe 87 PID 4152 wrote to memory of 4280 4152 cmd.exe 87 PID 4280 wrote to memory of 3212 4280 [email protected] 88 PID 4280 wrote to memory of 3212 4280 [email protected] 88 PID 4280 wrote to memory of 3212 4280 [email protected] 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe"C:\Users\Admin\AppData\Local\Temp\90cc1f227e008515f78a2f057f0569a04c6ebae69474ee2f26c057078c48779d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exePID:4152
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:4280
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 00.exe4⤵PID:3212
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize73KB
MD5423448d9782bf0cefc50248f34f2818f
SHA1656cdbfa6e1837bd1f59abe62013821a6571d355
SHA2566b41fed56e862f7cc97a739bb0e8ec2c7be362bf55724120551e42cca7950568
SHA5120555b73c552ab099d604ea3adc72822de5ce5417487ff2af8fc17eacb03fd51ea0ee0af5a195d506a6cdd1c8454a456cfdcd8eaad67213325ff5484bc7d0ace4
-
Filesize
2KB
MD57b621943a35e7f39cf89f50cc48d7b94
SHA12858a28cf60f38025fffcd0ba2ecfec8511c197d
SHA256bef04c2f89dc115ce2763558933dba1767bf30cda6856d335ae68955923f9991
SHA5124169e664ad4e7e6891a05ceed78465e0ec44879b37fc0de97c014945e10c161f6bfb040efc24edc136e69bb115b2a1327b04cefb58141f712da856129872e8f1