Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
9s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/04/2024, 20:41
Static task
static1
Behavioral task
behavioral1
Sample
GUI.exe
Resource
win11-20240412-en
General
-
Target
GUI.exe
-
Size
81KB
-
MD5
6b33e924889c6c7d9b4b5c0867aaf79e
-
SHA1
06e8bc356ae90e4176edf62c2d5eb0d1f882e7a8
-
SHA256
fcea93fa37e5b12901ae32909f836742caf9598739fd3223da19152b29eaabc5
-
SHA512
beb4c9cacc3acbba150aad6d46e3a4fca1cc985b000248335dbceebe198e9566bb104a04b1fdf61324a731ce31a1954fd82165888033c69c907a3dc34e50ca28
-
SSDEEP
1536:+2Y0VNblnigen1FQGpaika1PASjg/oIRk:+23rbZi/8GprF3jg/oqk
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3992 wrote to memory of 772 3992 GUI.exe 80 PID 3992 wrote to memory of 772 3992 GUI.exe 80 PID 3992 wrote to memory of 772 3992 GUI.exe 80 PID 772 wrote to memory of 2300 772 cmd.exe 81 PID 772 wrote to memory of 2300 772 cmd.exe 81 PID 772 wrote to memory of 2300 772 cmd.exe 81 PID 3992 wrote to memory of 2148 3992 GUI.exe 82 PID 3992 wrote to memory of 2148 3992 GUI.exe 82 PID 3992 wrote to memory of 2148 3992 GUI.exe 82 PID 3992 wrote to memory of 3004 3992 GUI.exe 84 PID 3992 wrote to memory of 3004 3992 GUI.exe 84 PID 3992 wrote to memory of 3004 3992 GUI.exe 84 PID 3992 wrote to memory of 3684 3992 GUI.exe 85 PID 3992 wrote to memory of 3684 3992 GUI.exe 85 PID 3992 wrote to memory of 3684 3992 GUI.exe 85 PID 3992 wrote to memory of 4376 3992 GUI.exe 86 PID 3992 wrote to memory of 4376 3992 GUI.exe 86 PID 3992 wrote to memory of 4376 3992 GUI.exe 86 PID 4376 wrote to memory of 444 4376 cmd.exe 87 PID 4376 wrote to memory of 444 4376 cmd.exe 87 PID 4376 wrote to memory of 444 4376 cmd.exe 87 PID 3992 wrote to memory of 2360 3992 GUI.exe 88 PID 3992 wrote to memory of 2360 3992 GUI.exe 88 PID 3992 wrote to memory of 2360 3992 GUI.exe 88 PID 3992 wrote to memory of 1416 3992 GUI.exe 89 PID 3992 wrote to memory of 1416 3992 GUI.exe 89 PID 3992 wrote to memory of 1416 3992 GUI.exe 89 PID 3992 wrote to memory of 1516 3992 GUI.exe 90 PID 3992 wrote to memory of 1516 3992 GUI.exe 90 PID 3992 wrote to memory of 1516 3992 GUI.exe 90 PID 3992 wrote to memory of 3452 3992 GUI.exe 91 PID 3992 wrote to memory of 3452 3992 GUI.exe 91 PID 3992 wrote to memory of 3452 3992 GUI.exe 91 PID 3992 wrote to memory of 2840 3992 GUI.exe 92 PID 3992 wrote to memory of 2840 3992 GUI.exe 92 PID 3992 wrote to memory of 2840 3992 GUI.exe 92 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 444 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GUI.exe"C:\Users\Admin\AppData\Local\Temp\GUI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c mode con:cols=0120 lines=00302⤵
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Windows\SysWOW64\mode.commode con:cols=0120 lines=00303⤵PID:2300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c title Window Title2⤵PID:2148
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"2⤵PID:3004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"2⤵PID:3684
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd2⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd3⤵
- Views/modifies file attributes
PID:444
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t2⤵PID:2360
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\i6.bat2⤵PID:1416
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c2⤵PID:1516
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:3452
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c2⤵PID:2840
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
173B
MD50f8f70e88009593eefaa155a8e31b1d6
SHA1eabcc3f2135e0919e9456da0a4b1084f3382d4b6
SHA256941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b
SHA51294df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750
-
Filesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74