Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/04/2024, 00:01
Static task
static1
Behavioral task
behavioral1
Sample
a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe
Resource
win10v2004-20231215-en
General
-
Target
a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe
-
Size
32KB
-
MD5
8c193a8f0c706fd5901f7a0cb5654e3d
-
SHA1
a0b59b32047808ec9fec8eed11196deeecd9d46f
-
SHA256
a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1
-
SHA512
9d0e36346584cb94af6db85528dfafac9922499f03860595fe88afe2daa5b1bcba1cd4a51dfaf1dcf29fe56e07d39816428642961552f99a0c23a88f801cdc5c
-
SSDEEP
384:Q98xUHQGTRO9mIy4Ng8zLeiQerUSreM1wRZn5jUa+jm71T+eE1DiRMECQv/Swg:Tw3TRid/gopVrDDa+jO1T+/1sCwSwg
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinHttp = "C:\\Users\\Admin\\AppData\\Local\\WinHttp.exe" regedit.exe -
Runs .reg file with regedit 1 IoCs
pid Process 4084 regedit.exe -
Suspicious behavior: RenamesItself 2 IoCs
pid Process 3944 a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe 3944 a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3944 wrote to memory of 4084 3944 a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe 84 PID 3944 wrote to memory of 4084 3944 a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe 84 PID 3944 wrote to memory of 4084 3944 a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe"C:\Users\Admin\AppData\Local\Temp\a52f49a474e12be266b78b90e88362d7bcc9dcdee65237c597ab3129e88555b1.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Users\Admin\AppData\Local\Temp\~dfds3.reg2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:4084
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
166B
MD5f44153ef26be29552cf320325ad8b72e
SHA174ac72ba2ff0f871e59b11c95ad707372662370c
SHA256767009fb8726500a4bc54b2ee744cc3ada64fdf16a44e22ff9dfe7652e2a439f
SHA5121d42a4dba1d8d0df9f8fedfba384ffdbcff3103c8ba360f255b5d7e8a46128f40521e4d16cf6de04365b3b6ffad8bc681cf7042d92867ab3d912601a3d5e6e65
-
Filesize
32KB
MD52de3865ba25d55c391339d603758c613
SHA1b826f7cc8e9f3b9f88e7b809c173653ce1b9b3ee
SHA256ef3a2c82f10d533d56b785ca9712e6cdf8bb02f148aa91f8d42bc45a19a98c03
SHA51257a28ea9b32a344abb8e1233fc10f48dd9642f912e036e86535a4023f8ada53985ae23d69a5fc1bc55242851f5c6ebc169889184c2e2f4ea5e851027ae159c7a