Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe
Resource
win10v2004-20231215-en
General
-
Target
c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe
-
Size
46.3MB
-
MD5
ae075dc74119a2f89609adbb4036c89c
-
SHA1
997a679651e30124d5544d37bd07f180728519a3
-
SHA256
c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b
-
SHA512
f2082e6bd9384cbc8d74536b3918b8ac46d7946c948d8f38cae41ce874b0126caabc6ebd3c32eb30013015ad376896cea90ccf8d300bc2edc290d10671c41827
-
SSDEEP
786432:qcn3/ROS+8p2CDev+J8wZEoVFVWCyeaWAEUabFmASJAlEML6qSNBC4ALQ9XMo:qc3pOS++2rmHhVFVjaDabRRLm6s
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3432 c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5264 wrote to memory of 3432 5264 c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe 84 PID 5264 wrote to memory of 3432 5264 c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe 84 PID 5264 wrote to memory of 3432 5264 c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe"C:\Users\Admin\AppData\Local\Temp\c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5264 -
C:\Users\Admin\AppData\Local\Temp\is-C1G6N.tmp\c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.tmp"C:\Users\Admin\AppData\Local\Temp\is-C1G6N.tmp\c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.tmp" /SL5="$F0050,48166959,121344,C:\Users\Admin\AppData\Local\Temp\c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.exe"2⤵
- Executes dropped EXE
PID:3432
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-C1G6N.tmp\c42a051120a4e7a3491ea95bc30ddcc2e8e46b8bb7479190c7b6e78e0590647b.tmp
Filesize1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb