Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 19:59
Static task
static1
Behavioral task
behavioral1
Sample
8bb779fdf8880b86c7811c1d468bb0ba.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8bb779fdf8880b86c7811c1d468bb0ba.exe
Resource
win10v2004-20240226-en
General
-
Target
8bb779fdf8880b86c7811c1d468bb0ba.exe
-
Size
929KB
-
MD5
8bb779fdf8880b86c7811c1d468bb0ba
-
SHA1
84297a76f4f5736b3c8e974226774862a356a390
-
SHA256
3f28e12c1b13cf6061d9c789ea81ac3fab126f377f90dade951ec0b66c0e81d1
-
SHA512
169f8f869897d3c94c6ac1a395f70faf947271df9b69392a140ff05d8dc44fae602430f952ca8d392251aa63f4f057404d3ae4f0988dd54475f49cb01cee731d
-
SSDEEP
24576:7I39dO9lvZdEt885tWVJRyWzKjnsRhhgebVKo0Ld8:76dq9Zd+8BVJUWzIsRDVbv4e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4476 is-P0GJV.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 972 wrote to memory of 4476 972 8bb779fdf8880b86c7811c1d468bb0ba.exe 85 PID 972 wrote to memory of 4476 972 8bb779fdf8880b86c7811c1d468bb0ba.exe 85 PID 972 wrote to memory of 4476 972 8bb779fdf8880b86c7811c1d468bb0ba.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8bb779fdf8880b86c7811c1d468bb0ba.exe"C:\Users\Admin\AppData\Local\Temp\8bb779fdf8880b86c7811c1d468bb0ba.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\is-4BUP5.tmp\is-P0GJV.tmp"C:\Users\Admin\AppData\Local\Temp\is-4BUP5.tmp\is-P0GJV.tmp" /SL4 $401E0 "C:\Users\Admin\AppData\Local\Temp\8bb779fdf8880b86c7811c1d468bb0ba.exe" 664162 522242⤵
- Executes dropped EXE
PID:4476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD5b683339ce008e97a0243a0f83bca1e09
SHA1a8a4c078225ec9d94912762bda3a745d83dbe8f4
SHA2565c6b8a1ab73cd03140040a3093e0d8466c666cd3fe17e8660dbc1a30d0b6f925
SHA512c39b2501f5887c363633c94b04d58396a0d285ff65963ed513e99ff2dd7f36da323904278c6a64b9f1f637aaeed17e3d9d40540baa9805369cc664a32c62c780