Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 00:08

General

  • Target

    a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace.exe

  • Size

    360KB

  • MD5

    5734fa65edfa6c4e36b2f28d895a6ead

  • SHA1

    61f2a6be3b86be4b2e220a77c0700b31f8316c34

  • SHA256

    a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace

  • SHA512

    edf56f844af0ead3080974c7f8a551cffe5a97399ee9817ab3bacbbd43ec0d47453cfeae467e1d8c34945ba7fa03b56b36981c1002cfded1df96a1a0ea715cfe

  • SSDEEP

    6144:vhbZ5hMTNFf8LAurlEzAX7oAwfSZ4sXUzQIL9:ZtXMzqrllX7XwfEIB

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • UPX packed file 46 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 26 IoCs
  • Modifies registry class 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace.exe
    "C:\Users\Admin\AppData\Local\Temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2100
    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202.exe
      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:968
      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202a.exe
        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202a.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3756
        • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202b.exe
          c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202b.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1456
          • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202c.exe
            c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202c.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1704
            • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202d.exe
              c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202d.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2568
              • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202e.exe
                c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202e.exe
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:3376
                • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202f.exe
                  c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202f.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:4512
                  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202g.exe
                    c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202g.exe
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:4100
                    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202h.exe
                      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202h.exe
                      10⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:4344
                      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202i.exe
                        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202i.exe
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4972
                        • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202j.exe
                          c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202j.exe
                          12⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:4636
                          • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202k.exe
                            c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202k.exe
                            13⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:3320
                            • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202l.exe
                              c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202l.exe
                              14⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:1696
                              • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202m.exe
                                c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202m.exe
                                15⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:4516
                                • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202n.exe
                                  c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202n.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:4652
                                  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202o.exe
                                    c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202o.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:4208
                                    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202p.exe
                                      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202p.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:4064
                                      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202q.exe
                                        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202q.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:3660
                                        • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202r.exe
                                          c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202r.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:3900
                                          • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202s.exe
                                            c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202s.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:3532
                                            • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202t.exe
                                              c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202t.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:3120
                                              • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202u.exe
                                                c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202u.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Modifies registry class
                                                PID:916
                                                • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202v.exe
                                                  c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202v.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:1812
                                                  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202w.exe
                                                    c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202w.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Modifies registry class
                                                    PID:412
                                                    • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202x.exe
                                                      c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202x.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Modifies registry class
                                                      PID:2144
                                                      • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202y.exe
                                                        c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202y.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202.exe

    Filesize

    360KB

    MD5

    7e6b4a3b7df69f2517eb1170cf5158ee

    SHA1

    8b792b75e06af14fab087bafaab85acb1bc7f9eb

    SHA256

    96c97aa16eb90658ed82ca9d55695cf10e97c93f632ae671351055f92f180d2e

    SHA512

    f3ab9fc830caff4c98f5136da57ef9bad76310505ac7c5e8c2103fe566e7b9ed82dadb8b51080956c9545b0d19f5e999180c26302fba7180c7b897929c17a028

  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202c.exe

    Filesize

    360KB

    MD5

    83fa96053ba4ec8c422de3950e95354a

    SHA1

    fc14e2f01c046394bd1922e53bb4d64de57ed47f

    SHA256

    6bde0d0b5e5811e10eb5c7f8d5ff381626f0e4b207ae2e15c0e25a8131c240e0

    SHA512

    bd10e5d75f1bf583b4eca9a40e9664a5437147901eac705b47a041a1a14d7e927652760c4f4ee85acfd2a81fde03f5f2b53658c4121e54da8dd3b78ad22785d6

  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202o.exe

    Filesize

    360KB

    MD5

    3dc8e6aa5f533ef309ac2d4f01f5e145

    SHA1

    255b11f6b2f460169f7d056dae0ed10d84834705

    SHA256

    36a775f5923acc9c5cc2d5793ab879a61fb7f4e06a0179ed79e7c03ac3045bf1

    SHA512

    f72b8d6d1835f0e787778f9a1583ec83df1e620248e34b83ef92b3d1db7e75e6eb70d9ebf9be2671a41442d87f6784505cda19748d94008604c7491ac5535f55

  • \??\c:\users\admin\appdata\local\temp\a862f4cca5f31d6dc7be5eac6106da3755d51c94d46fea67e4a59737006adace_3202u.exe

    Filesize

    360KB

    MD5

    2b99a92825aa433201a7d40bb0dbc103

    SHA1

    25cc4e71960a3c6d1b3393dffd8a88769e07612d

    SHA256

    ca6479dea6519093a685636e119fd904e37d9f74ab66395333623cc17adadbb0

    SHA512

    8faccde6e39c561f799bcb59e6e1bc028172b95dfdec8ee99527a6e22df1d23fe8f2032b7023513164e8eaa8abce0da2db2bc9ce5b311b8965ff61fedd5b0fcc

  • memory/412-246-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/412-230-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/916-216-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/968-8-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/968-124-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1456-34-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1456-137-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1696-128-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1696-125-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1704-42-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1704-147-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1812-225-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/1812-227-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2100-15-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2100-0-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2144-239-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2144-249-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2568-45-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2568-167-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2660-250-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3120-200-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3120-215-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3320-116-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3376-65-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3376-60-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3532-199-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3660-187-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3660-169-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3756-27-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/3900-195-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4064-166-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4100-79-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4100-185-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4208-159-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4208-150-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4344-88-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4344-217-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4512-64-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4512-171-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4516-139-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4636-114-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4652-146-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/4972-105-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB