Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 00:01

General

  • Target

    a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe

  • Size

    32KB

  • MD5

    8c193a8f0c706fd5901f7a0cb5654e3d

  • SHA1

    a0b59b32047808ec9fec8eed11196deeecd9d46f

  • SHA256

    a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1

  • SHA512

    9d0e36346584cb94af6db85528dfafac9922499f03860595fe88afe2daa5b1bcba1cd4a51dfaf1dcf29fe56e07d39816428642961552f99a0c23a88f801cdc5c

  • SSDEEP

    384:Q98xUHQGTRO9mIy4Ng8zLeiQerUSreM1wRZn5jUa+jm71T+eE1DiRMECQv/Swg:Tw3TRid/gopVrDDa+jO1T+/1sCwSwg

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: RenamesItself 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe
    "C:\Users\Admin\AppData\Local\Temp\a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Windows\SysWOW64\regedit.exe
      regedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg
      2⤵
      • Adds Run key to start application
      • Runs .reg file with regedit
      PID:4084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~dfds3.reg

    Filesize

    166B

    MD5

    f44153ef26be29552cf320325ad8b72e

    SHA1

    74ac72ba2ff0f871e59b11c95ad707372662370c

    SHA256

    767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f

    SHA512

    1d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65

  • C:\Users\Admin\AppData\Local\WinHttp.exe

    Filesize

    32KB

    MD5

    2de3865ba25d55c391339d603758c613

    SHA1

    b826f7cc8e9f3b9f88e7b809c173653ce1b9b3ee

    SHA256

    ef3a2c82f10d533d56b785ca9712e6cdf8bb02f148aa91f8d42bc45a19a98c03

    SHA512

    57a28ea9b32a344abb8e1233fc10f48dd9642f912e036e86535a4023f8ada53985ae23d69a5fc1bc55242851f5c6ebc169889184c2e2f4ea5e851027ae159c7a

  • memory/3944-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/3944-10-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB