Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/04/2024, 14:12

240412-rjbyxaba69 10

12/04/2024, 13:53

240412-q61p4sea2y 8

12/04/2024, 13:52

240412-q6cy2sea2v 7

12/04/2024, 13:51

240412-q6cchsea2s 10

12/04/2024, 13:51

240412-q6b2raah72 10

09/04/2024, 06:39

240409-heygnsca4y 8

09/04/2024, 06:39

240409-hern5agf52 8

09/04/2024, 06:38

240409-heg5pagf47 10

09/04/2024, 06:38

240409-hebmxagf45 8

18/12/2023, 04:48

231218-fe484sadc4 10

Analysis

  • max time kernel
    127s
  • max time network
    301s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 06:38

General

  • Target

    0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe

  • Size

    1.9MB

  • MD5

    1543d5f2bf658fb837d5aabf4c81d6c1

  • SHA1

    f7d25bba549095a63e75174a6318aae83fca1326

  • SHA256

    0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b

  • SHA512

    569d08943cf4e12a0f87d01760f8aa60cf20cb846f49724ee827585f6670f33f3dc3e088e453ec2bb9f490b66d1a16153c435d9f7cb9ffab98cf23c481227e36

  • SSDEEP

    49152:gWRJu3Kbha03xUDhZSG5JgFCDT72+yZR64ooyHWUUz7fY0vE:gdU/WDhc7FNZR/h3

Score
7/10

Malware Config

Signatures

  • UPX packed file 53 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
    "C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe
      "C:\Users\Admin\AppData\Local\Temp\0e0f1e9b6ef23a6f9a81442521969df413664441c8da9c0de75395827d61763b.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      PID:2632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdesc-consensus.tmp

    Filesize

    2.6MB

    MD5

    9bae03d3dc0f5cfd40507ee03ba5a765

    SHA1

    bbb2ea791c2e53e615f7c4b17246b4d465e6a4fe

    SHA256

    ff1af3cc0eff747f5425287eea2910d8d69cd9d30af5a90a41a03a023bb0313f

    SHA512

    2263b74eefd835f92a085f1b35e156b79c37996b1976d6b93ad94cfce8454411131d4b3dc1d3d3cee175b37d05433f3061060023219d7d3da86e034e510b7b81

  • C:\Users\Admin\AppData\Local\Temp\4KPV6A~1\cached-microdescs.new

    Filesize

    6.2MB

    MD5

    eee0a3bf0bc1f1332c87106ff1fb1662

    SHA1

    e437b023acb1a882e654b30ee2300fef65784e67

    SHA256

    4ec2579383939b5f6ee2e687c58fe2402ff372b12b64ef22ff1101c55b19a40f

    SHA512

    b608d02615eccffbb94e5c8d21ea42644dc9cd0f4471fe966598784a7b9e25dd0e9b96c0a60ba6fd4ca3c58342fd720c92712f622613e5f4b37a2c23fa33ca58

  • memory/2632-3-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-5-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-6-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-7-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-8-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-9-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-28-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-29-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-30-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-31-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-32-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-37-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-38-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-45-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-54-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-55-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-59-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-60-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-64-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-65-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-66-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-67-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-69-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-74-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-75-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-82-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-88-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-87-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-94-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-90-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-89-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-81-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-86-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-79-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-85-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-84-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-83-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-78-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-76-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-71-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-98-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-110-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-112-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-111-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-109-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-104-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-102-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-96-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-95-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-105-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-92-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-101-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2632-99-0x0000000000400000-0x0000000000848000-memory.dmp

    Filesize

    4.3MB

  • memory/2964-1-0x00000000028C0000-0x0000000002A84000-memory.dmp

    Filesize

    1.8MB

  • memory/2964-2-0x0000000002A90000-0x0000000002C47000-memory.dmp

    Filesize

    1.7MB