Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    87s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 00:02

General

  • Target

    a58fd625bf63b8a73ef378fe80f7570a26926089df7196dc4254011aaf3b4ed5.exe

  • Size

    449KB

  • MD5

    74fe65d5e23e006e59e09de6e3c92e15

  • SHA1

    571424032ebbd55453af2a725357183ef94a23d4

  • SHA256

    a58fd625bf63b8a73ef378fe80f7570a26926089df7196dc4254011aaf3b4ed5

  • SHA512

    6f13e6e6cc9026b014aabb1ec1e06b756adabe7b8a9fc267a99c1ef234a1a0fd2b3ba5d9f673addd9a2932601200c79157bfe6d995b2cd35f13b7115ae3f1055

  • SSDEEP

    12288:NJu6lfyi4fabr9jy4BNKOSuDVh+vh4tH1jo3rqsh2T:N8XfyhLNKQVhKutH1jo3Phu

Score
9/10

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 2 IoCs
  • Modifies AppInit DLL entries 2 TTPs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a58fd625bf63b8a73ef378fe80f7570a26926089df7196dc4254011aaf3b4ed5.exe
    "C:\Users\Admin\AppData\Local\Temp\a58fd625bf63b8a73ef378fe80f7570a26926089df7196dc4254011aaf3b4ed5.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2428
  • C:\PROGRA~3\Mozilla\frviiqj.exe
    C:\PROGRA~3\Mozilla\frviiqj.exe -myayasb
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Mozilla\frviiqj.exe

    Filesize

    449KB

    MD5

    c9634b9e4dac3039731c06cf47449034

    SHA1

    4db197c901064b885714091b3195050059059ab7

    SHA256

    536d929d73cd8e4bbef9f046c0abd2e4c4dd09039053b6d5b9f54f54c0978b61

    SHA512

    55e5f1c2496a2784bf752fff783b02a895d547d4bab070d5afbc7bbb191a8bb85b1d03397a273c88c599fa9ade6d99639b95f88f8cae8faa78796d2c3cb305a7

  • memory/2428-0-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2428-2-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2428-1-0x0000000002200000-0x000000000225B000-memory.dmp

    Filesize

    364KB

  • memory/2428-5-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2644-8-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2644-9-0x0000000000C50000-0x0000000000CAB000-memory.dmp

    Filesize

    364KB

  • memory/2644-10-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2644-13-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB