Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
c62009b1faa1b3c4b99e04f5e6ae3f45.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
c62009b1faa1b3c4b99e04f5e6ae3f45.exe
Resource
win10v2004-20231215-en
General
-
Target
c62009b1faa1b3c4b99e04f5e6ae3f45.exe
-
Size
385KB
-
MD5
c62009b1faa1b3c4b99e04f5e6ae3f45
-
SHA1
26e3fb5621d7ce06c981600d865820d0dda911c3
-
SHA256
66b17c34e4b21acc273a7f62253606aff32bfde2bdae054e2d70f8ca76a7c702
-
SHA512
624a802ef641b75d1c034b6f58194ac82c3c722e2be7d1527e1c659e9fe672a2d4cfa1be45746a4d2a97173d7428046192cf6cc1a539d78d912a1f8abed1809d
-
SSDEEP
12288:XDBcEd40Wth/s7QCDG7RFLq1YV/0TJZTIGB:Xt4iD+qTTJaGB
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4040 c62009b1faa1b3c4b99e04f5e6ae3f45.exe -
Executes dropped EXE 1 IoCs
pid Process 4040 c62009b1faa1b3c4b99e04f5e6ae3f45.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 2 pastebin.com 5 pastebin.com -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1952 c62009b1faa1b3c4b99e04f5e6ae3f45.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1952 c62009b1faa1b3c4b99e04f5e6ae3f45.exe 4040 c62009b1faa1b3c4b99e04f5e6ae3f45.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1952 wrote to memory of 4040 1952 c62009b1faa1b3c4b99e04f5e6ae3f45.exe 85 PID 1952 wrote to memory of 4040 1952 c62009b1faa1b3c4b99e04f5e6ae3f45.exe 85 PID 1952 wrote to memory of 4040 1952 c62009b1faa1b3c4b99e04f5e6ae3f45.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe"C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exeC:\Users\Admin\AppData\Local\Temp\c62009b1faa1b3c4b99e04f5e6ae3f45.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:4040
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5bb66ad068ae53629a5b529d838b9d547
SHA194c035ce543e1dca39bf58928ab2b3247d0309b1
SHA25649a7813389a51359afe44036ec3334ba8892a353912d74e940508761877d3006
SHA512efada4f8f5b5b9fd1432fee653877eb39f0f57c16b9880293cf07de56ff749da5d2aaedf9da25e07c01cf7436138a490f0842488c1f13a5849bea67f8896e4f8