Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 04:14
Static task
static1
Behavioral task
behavioral1
Sample
c4f11305f66bb6c35e66b2096c6bb69f.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c4f11305f66bb6c35e66b2096c6bb69f.exe
Resource
win10v2004-20240226-en
General
-
Target
c4f11305f66bb6c35e66b2096c6bb69f.exe
-
Size
82KB
-
MD5
c4f11305f66bb6c35e66b2096c6bb69f
-
SHA1
881f9529a7a27ef2932f3b0c736c94c92477657e
-
SHA256
44ee1a31730fe468072a0d73bd2ee55b750a551756facb3ddf388b71340430ef
-
SHA512
827616af60438172383e827403283ac779ad9dab9ce8a87c9ef1d865a14bdd177407f46c7eb6d789e2e3d1b602b60fd0dc544c2ea831d270ef237810e7d72be7
-
SSDEEP
1536:KrEIpHdT4PenRkVRJY6SLpyZsP6UWjm7FkhnHzmIq7AheL0S61Y8/Mkq:KwUdUckVRsyM6piFk9mIqUheJEakq
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4776 c4f11305f66bb6c35e66b2096c6bb69f.exe -
Executes dropped EXE 1 IoCs
pid Process 4776 c4f11305f66bb6c35e66b2096c6bb69f.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4756 c4f11305f66bb6c35e66b2096c6bb69f.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4756 c4f11305f66bb6c35e66b2096c6bb69f.exe 4776 c4f11305f66bb6c35e66b2096c6bb69f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4776 4756 c4f11305f66bb6c35e66b2096c6bb69f.exe 89 PID 4756 wrote to memory of 4776 4756 c4f11305f66bb6c35e66b2096c6bb69f.exe 89 PID 4756 wrote to memory of 4776 4756 c4f11305f66bb6c35e66b2096c6bb69f.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4f11305f66bb6c35e66b2096c6bb69f.exe"C:\Users\Admin\AppData\Local\Temp\c4f11305f66bb6c35e66b2096c6bb69f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\c4f11305f66bb6c35e66b2096c6bb69f.exeC:\Users\Admin\AppData\Local\Temp\c4f11305f66bb6c35e66b2096c6bb69f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4776
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD54c24a2ceffdc748d665e74096caf0d3b
SHA137a0f70bede913f7f7e35648379ea528b1c7f424
SHA256d39802c72ed19cde321d10c45b5a3705c8293589556f4a3b73e4bb0e86db2e81
SHA5127509507d36369dcd7fdd6baaceab192645a18502e3d4a8ee207abc11190b7a93a83eabb53f46ff50d273d9922014ac6f6ce5f1dd4cc9200815502e6e4b113b3f