Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe
Resource
win10v2004-20240226-en
General
-
Target
0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe
-
Size
63KB
-
MD5
6d4c9d750cc1a56abd7bc252111ba6cc
-
SHA1
c789986233e7b6160e4d06c9810a0d96535ba1ed
-
SHA256
0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73
-
SHA512
35dddef9a09dfdf6a68be61060f96342822c938ca31919392c198cd66cc62d369ff2ddad6a236ba351d1788acd1a7de4272999d535112e7591c763d1094a320d
-
SSDEEP
768:SCru/f9UwfE6zy4n8uZ5tUXMJ+fROUmELY2glEbM3j+rd+fpkXVTWkReOOq:GRzzy48untU8fOMEI3jyYf6llOq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4356 wrote to memory of 2096 4356 0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe 89 PID 4356 wrote to memory of 2096 4356 0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe 89 PID 4356 wrote to memory of 2096 4356 0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe 89 PID 2096 wrote to memory of 1856 2096 cmd.exe 90 PID 2096 wrote to memory of 1856 2096 cmd.exe 90 PID 2096 wrote to memory of 1856 2096 cmd.exe 90 PID 1856 wrote to memory of 4188 1856 iexpress.exe 91 PID 1856 wrote to memory of 4188 1856 iexpress.exe 91 PID 1856 wrote to memory of 4188 1856 iexpress.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe"C:\Users\Admin\AppData\Local\Temp\0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4323.tmp\1.bat" "C:\Users\Admin\AppData\Local\Temp\0a1534e649064cde07fb82d6be590bad7d7fac811ed297b5f282d40125725b73.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\iexpress.exeiexpress /n /q /m C:\Users\Admin\AppData\Local\Temp\popup.sed3⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\makecab.exeC:\Windows\SysWOW64\makecab.exe /f "~%TargetName%.DDF"4⤵PID:4188
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD502dba5f37067292355c6d01a57d4ef48
SHA17c67ab3f99fbf7a53018dd295d2968c525db83d9
SHA2568b74c812ba9e6c536da7edd4101e7e0dddeab8355e5aff095dd31b3f00560242
SHA51212201f949ee3198c8f4b39cc8edf90a114ecf42ddd5383ed0b87e4c78053cd517786dc7af83557e63a0483af74f4c0117d5568441ae761ff6958e758704d602a
-
Filesize
63KB
MD57642472a4b329ff97e4ea1516e0419ff
SHA1ea2b364dd3179aa5a00501bd0f56712a1bb869ae
SHA256bdfbf8014776f9425dc8d661c3d59562b4257b0c45fdb0d681c19c6dd7fbba37
SHA5122034229d2471f8d8096040148a1fcc7595335eaa0bc0eb79abd4402c8a639ed5796d78cfefafeed68ddc0efc377b178a1275354e8b36b96f9d1e3c3cf3826528
-
Filesize
724B
MD5c3ca008abd6997c4b036a7e8be75cb2c
SHA105f7a3527bb04c691b08f040f562582035398829
SHA25629ef6bf47dcc8c67f1abe1b269d3518d6a4ebe125daa1ea460779638cb9782a3
SHA512bee0baf3cb83144239077f99f5ca2a6ca7b618f7f51a53e03613ae697e8bc76fa28f5d006296b469be8e1fffeeb35668b5fe87b260b1380cc003815ea9efb083