Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 12:12
Behavioral task
behavioral1
Sample
ddfb773c777f833dd62af65374f485b3.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
ddfb773c777f833dd62af65374f485b3.exe
Resource
win10v2004-20240319-en
General
-
Target
ddfb773c777f833dd62af65374f485b3.exe
-
Size
2.7MB
-
MD5
ddfb773c777f833dd62af65374f485b3
-
SHA1
c90a7f4faed536336d40066b5580e2207d030925
-
SHA256
e72112189432a6236c35351d221864675d6c11489cf1ee4ac7efbc38de906245
-
SHA512
e03660100d113f8fd4044bb0f2133f380da1803a367ff5107d9e5c9c5b385cd5eb5bcde5d73c1a3a67341e2529f74cd35acbc4642c6189cc260bbe3ab47a3499
-
SSDEEP
49152:wjcVdONFKPIlaGPiltTvICsO7XygRhZ1Bonf:wjceKRGPpqbyMhZ4f
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2632 ddfb773c777f833dd62af65374f485b3.exe -
Executes dropped EXE 1 IoCs
pid Process 2632 ddfb773c777f833dd62af65374f485b3.exe -
resource yara_rule behavioral2/memory/4292-0-0x0000000000400000-0x000000000086A000-memory.dmp upx behavioral2/files/0x000800000002331e-12.dat upx behavioral2/memory/2632-14-0x0000000000400000-0x000000000086A000-memory.dmp upx -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4292 ddfb773c777f833dd62af65374f485b3.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4292 ddfb773c777f833dd62af65374f485b3.exe 2632 ddfb773c777f833dd62af65374f485b3.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4292 wrote to memory of 2632 4292 ddfb773c777f833dd62af65374f485b3.exe 94 PID 4292 wrote to memory of 2632 4292 ddfb773c777f833dd62af65374f485b3.exe 94 PID 4292 wrote to memory of 2632 4292 ddfb773c777f833dd62af65374f485b3.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exe"C:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exeC:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4488 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:81⤵PID:3784
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5eb84639d30d0e6a27c64e25b1b3ca3ad
SHA19d1f828125896ab41634db869c7dd38c8ee4ad3d
SHA256addbd51f8086b8cccfa532ec94e839bff2f4e61396b006a1fe423d452c08bf90
SHA512a2e20c7562fd6233cf7ca19c591041029f6cf09329843d3e84a0c33b8f40fc905bc33a0fd819b477c6767dea34ee3163829555004df3df5371a687df253b3a7d