Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 18:18

General

  • Target

    06a91e8e1ac6486de2e39456f2d4162af7ecb982d6edd812cd5c8f0fc4385f4f.exe

  • Size

    80KB

  • MD5

    e2ad66d8046b31a89df4995ecb88a3ae

  • SHA1

    9919a309f9368312135ae6d59c55e4e828cffee3

  • SHA256

    06a91e8e1ac6486de2e39456f2d4162af7ecb982d6edd812cd5c8f0fc4385f4f

  • SHA512

    a467843faf00652fbf82c72210c4ef838b687c8ba4e577141cba882bc36fc72182e8456ae97265a529eb978a4a3ff1f73e2073c7501c60094cf273944c57e908

  • SSDEEP

    1536:YAowfUJFgjT284U+w2EwRz6OlvaeEpIaCtwUaSvcmGCCCCCHCChCHCCCdg1WCCCe:YAowyFgjTiUkEwt6OlvaeEpIaCtwUaSh

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06a91e8e1ac6486de2e39456f2d4162af7ecb982d6edd812cd5c8f0fc4385f4f.exe
    "C:\Users\Admin\AppData\Local\Temp\06a91e8e1ac6486de2e39456f2d4162af7ecb982d6edd812cd5c8f0fc4385f4f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    80KB

    MD5

    a46b4792b18551b4e1314d7baae2daf0

    SHA1

    78ccb067b4e2d3004f81f4086f324caee54fe07d

    SHA256

    16a6af0747f571d83b643f4794e624dcec3bfe8d134333e9e9201eaa5e350fee

    SHA512

    109692607f4594826647cbddfa8059a36320fc5051127ded8a357c6ec8ce8e511109cacb0a538ba28558aa23245526d7a0e699de266a3484d15ca5a1d57ed25c

  • memory/1084-6-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/1084-7-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/4688-0-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB

  • memory/4688-4-0x0000000000400000-0x0000000000410000-memory.dmp

    Filesize

    64KB