Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/03/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
cb315dd8e548147363fc1b4918acf5ff.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cb315dd8e548147363fc1b4918acf5ff.exe
Resource
win10v2004-20240226-en
General
-
Target
cb315dd8e548147363fc1b4918acf5ff.exe
-
Size
240KB
-
MD5
cb315dd8e548147363fc1b4918acf5ff
-
SHA1
fb03a36d96c4ae09e10bcf97b21d460ef10814ea
-
SHA256
ddba1639ca77a149f99c895bf63924c6303944ce464815b57d3f7621d7217a1a
-
SHA512
25f4f9429e6ac9159cf994f0fbc653475ea77e509661a1998043d2fc2d32a7ff9d27bd6eba4d42b17ec73d821e923ac025d1f301152aba65dccbc8eabfe67bf2
-
SSDEEP
3072:pyZnxPhKmthndqtIExkr3TL2eqWN/CuTfetol457t2GpsnGTll7lWntUZ7T:pyVvrtStIExkD+GVTfbIprllpzZ7T
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oHTZLu3kUs3FH = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cb315dd8e548147363fc1b4918acf5ff.exe" cb315dd8e548147363fc1b4918acf5ff.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4204 cb315dd8e548147363fc1b4918acf5ff.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4204 wrote to memory of 228 4204 cb315dd8e548147363fc1b4918acf5ff.exe 112 PID 4204 wrote to memory of 228 4204 cb315dd8e548147363fc1b4918acf5ff.exe 112 PID 4204 wrote to memory of 228 4204 cb315dd8e548147363fc1b4918acf5ff.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb315dd8e548147363fc1b4918acf5ff.exe"C:\Users\Admin\AppData\Local\Temp\cb315dd8e548147363fc1b4918acf5ff.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\gpdelrec.bat2⤵PID:228
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
250B
MD57a43b9205cea3db0fb21d85f803285cd
SHA1a1af5411aef7dbfba574e559925cef8f1fbcf1dc
SHA25624bfd47e585c9e446367b26e9e12168c06cff5c87d0d7011e5c6ce32a86010ba
SHA512d8900a609e508049eedd0e72a8b62a81fd3e1119c97f27e8aa423c67fd869806b83d8717e1316ef3167720a0322d39744e1c932028412ff799c61c9143a23f62