Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 20:11
Static task
static1
Behavioral task
behavioral1
Sample
2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe
Resource
win10v2004-20240412-en
General
-
Target
2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe
-
Size
668KB
-
MD5
aa92ad095229171fc1b4209798ff4d1c
-
SHA1
3d1715c146d3b5d57f583eebb91a964242b7cc0d
-
SHA256
2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0
-
SHA512
c815529b71762a9f3c95e577d602a0d39ae0e8aa640fac058e4f4be50104a5198c31679ad92263b9e367e71bb3c9a702850621da8e9bac9cc588515688237ec7
-
SSDEEP
12288:UWBm+95nHfF2mgewFx5zPooWlU1kfgjdkAZgewF:UWBz95ndbgfx5LUgjTZgf
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3520 5469.tmp -
Executes dropped EXE 1 IoCs
pid Process 3520 5469.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4408 wrote to memory of 3520 4408 2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe 86 PID 4408 wrote to memory of 3520 4408 2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe 86 PID 4408 wrote to memory of 3520 4408 2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe"C:\Users\Admin\AppData\Local\Temp\2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2f929139cea2679d31f402a5d362becdbae476be9d0049851bc5eb8b6664e2f0.exe 0FE429058BCFF3014F39E2AE3A8420DDA0258D4000A50898CFCC718798C3DAFB4975BC1925DF992CD4C721797B819C4E6022D679B763D8FE12E023D43F100F272⤵
- Deletes itself
- Executes dropped EXE
PID:3520
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668KB
MD5a36175bc45d5f3a7d001ad789c2b4c99
SHA1b4d0f081f7c88b5416a061e30d6eb40d7b7a753a
SHA256ae50abb8b7fdcf2617525f45ea6dd6176deacafe93f80ca16b324c1816b29c21
SHA512a48d2ffbfa5b7cd66b0fd2f4624256cdba63c83682555d051b55485fbd06f83d89b7bd9c755c694081d0a2661ae63e435d047782682227da4ee0735a707b2710