Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2024, 23:41

General

  • Target

    7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe

  • Size

    5.4MB

  • MD5

    bc5004b1cedaf1eb95b1ad680594db4b

  • SHA1

    1e6c7cf4b5198a56c05cf988da4df9da3fdd2ffa

  • SHA256

    7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf

  • SHA512

    69eb68562bd6fa77143da20ec032c2358b6791506ac272cec3377f1dddde02f3f428891c0914fac7d7b0b0846bedc5bf3d49d2d6b236f2317c6773c9eefbdd54

  • SSDEEP

    98304:emhd1UryeokPmmx47M1+zU+MV7wQqZUha5jtSyZIUh:elIMmmq7FjM2QbaZtliU

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe
    "C:\Users\Admin\AppData\Local\Temp\7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Users\Admin\AppData\Local\Temp\6774.tmp
      "C:\Users\Admin\AppData\Local\Temp\6774.tmp" --splashC:\Users\Admin\AppData\Local\Temp\7ad3bd362c80f0400fcd144cade6a910b48be355980b9d9d8c742baf1f066bbf.exe 5A4C8A950C7C13B1058E9AB26A0D32EEB9301030D78B197C9B86BE254485F077710722770DD2FCDAD2FAB675C1F7193E568FCBC8A4E508258F6C54B8A4D82D8A
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6774.tmp

    Filesize

    5.4MB

    MD5

    80ea0af3c6643ffacb4f57fcc9cbca0f

    SHA1

    92b10ef0ffd18c7c385205c703a237a92fbfa2d4

    SHA256

    c9836fed70a1a750584ee3718836568b8f7b99cb652c7f1e31b1f089b98fe57f

    SHA512

    7759df7988adb37c821814a50b9b4e5bf4ab76738ebbe6606bc09f8e876c7526c9754e9eff0e69a6826d51a55358b2bd5b1a0076d6ed2f5211ec646b5c8c2104

  • memory/1212-0-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB

  • memory/2484-5-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB