Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 23:41
Static task
static1
Behavioral task
behavioral1
Sample
7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe
Resource
win10v2004-20240412-en
General
-
Target
7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe
-
Size
5.4MB
-
MD5
bc5004b1cedaf1eb95b1ad680594db4b
-
SHA1
1e6c7cf4b5198a56c05cf988da4df9da3fdd2ffa
-
SHA256
7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf
-
SHA512
69eb68562bd6fa77143da20ec032c2358b6791506ac272cec3377f1dddde02f3f428891c0914fac7d7b0b0846bedc5bf3d49d2d6b236f2317c6773c9eefbdd54
-
SSDEEP
98304:emhd1UryeokPmmx47M1+zU+MV7wQqZUha5jtSyZIUh:elIMmmq7FjM2QbaZtliU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2484 6774.tmp -
Executes dropped EXE 1 IoCs
pid Process 2484 6774.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1212 wrote to memory of 2484 1212 7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe 89 PID 1212 wrote to memory of 2484 1212 7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe 89 PID 1212 wrote to memory of 2484 1212 7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe"C:\Users\Admin\AppData\Local\Temp\7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp" --splashC:\Users\Admin\AppData\Local\Temp\7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe 5A4C8A950C7C13B1058E9AB26A0D32EEB9301030D78B197C9B86BE254485F077710722770DD2FCDAD2FAB675C1F7193E568FCBC8A4E508258F6C54B8A4D82D8A2⤵
- Deletes itself
- Executes dropped EXE
PID:2484
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD580ea0af3c6643ffacb4f57fcc9cbca0f
SHA192b10ef0ffd18c7c385205c703a237a92fbfa2d4
SHA256c9836fed70a1a750584ee3718836568b8f7b99cb652c7f1e31b1f089b98fe57f
SHA5127759df7988adb37c821814a50b9b4e5bf4ab76738ebbe6606bc09f8e876c7526c9754e9eff0e69a6826d51a55358b2bd5b1a0076d6ed2f5211ec646b5c8c2104