Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 10:59
Static task
static1
Behavioral task
behavioral1
Sample
ddd8c093f1159d62ec339b5f708028a2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ddd8c093f1159d62ec339b5f708028a2.exe
Resource
win10v2004-20240226-en
General
-
Target
ddd8c093f1159d62ec339b5f708028a2.exe
-
Size
13.2MB
-
MD5
ddd8c093f1159d62ec339b5f708028a2
-
SHA1
deb1313768486adb85a3fd8fde62405c26b3be5e
-
SHA256
581dae7d1fbe30dc7fb6d343cb749f1445de1031e9fa1215a49b9e64cc8aa5a6
-
SHA512
0cc7e020787c2cb9d6e39e9b14c3d39fd8724366906c3afd59f0b2e16acccb7ed51dfec2ab15fbe234e62a567f2e67a8878befe911fc70e3298682fb27d6d2b2
-
SSDEEP
49152:EQFRHrmQG+yrwrTyRpL3rwrIrwrTvL3rwrtwrIrSRpL3rwrIrwrTvL3rwrtwrIrr:EcKTy/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1544 ae.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1544 ae.exe 1544 ae.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 416 wrote to memory of 1544 416 ddd8c093f1159d62ec339b5f708028a2.exe 91 PID 416 wrote to memory of 1544 416 ddd8c093f1159d62ec339b5f708028a2.exe 91 PID 416 wrote to memory of 1544 416 ddd8c093f1159d62ec339b5f708028a2.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddd8c093f1159d62ec339b5f708028a2.exe"C:\Users\Admin\AppData\Local\Temp\ddd8c093f1159d62ec339b5f708028a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\ae.exeC:\Users\Admin\AppData\Local\Temp\ae.exe -run C:\Users\Admin\AppData\Local\Temp\ddd8c093f1159d62ec339b5f708028a2.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1544
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD58e9d366cc77ee61f659f8ddc9a2b3095
SHA17b4acf00e1f7f927c81a8b5b90b83bfd7bc9ebe2
SHA2567c18091fe25c397c69a0ae0a7736a4d1b517149b70ec14dc0f49d8c1d9d8f365
SHA512dcf454407a8b1890bf10519f4c5f6293f3a2724c9d245c9da4c128b1c8173d2b7b96ab8779f0c45019c7b10579a2e1a0064fce8b69e0b759a71550cd67aab110
-
Filesize
898KB
MD5dc6350864fc92ccdba271af0ae48cc1e
SHA14368718dd05f03002f68a03685e6cf96a16027e2
SHA2565b677ab93c14e94e440703cd4baaf7163d072a7b61c32ceef7f17ed3e03a6486
SHA5125070025f177c5a54d2ea49fe07fc5e194e4dc39e71f46fbbe5ef22f4c5bdc6e62a94d6c17ad9abc523987ae2bbddcb418c54164cf53b62f1db7f24cc4e8005eb