Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23/04/2024, 19:01
Static task
static1
Behavioral task
behavioral1
Sample
ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403.exe
Resource
win10v2004-20240412-en
General
-
Target
ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403.exe
-
Size
462KB
-
MD5
d0b5e3c428212e1dd3acd07c3392f0eb
-
SHA1
9f2761d8fce5604d62fc09f8513eaf84f47f4155
-
SHA256
ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403
-
SHA512
0bcfcdb01273d3a53558913d600b03d18aa46c121c8ed77096d93d116dde3041a7e2cea69aabd3368d2a2f87598022f7a0a37b558b139a68a4cbf7480c1c779a
-
SSDEEP
12288:sn6oPSHN9AVHibrbWXIRsReDhmrDira9vzLCI6:A6+U9WHiTNRRAhD6
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 5112 u9k.0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 344 wrote to memory of 5112 344 ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403.exe 78 PID 344 wrote to memory of 5112 344 ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403.exe 78 PID 344 wrote to memory of 5112 344 ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403.exe"C:\Users\Admin\AppData\Local\Temp\ee7b24cc0be20e605d042d3c2ddb56cb0bf9e10582649b5504ecf60276af7403.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\Temp\u9k.0.exe"C:\Users\Admin\AppData\Local\Temp\u9k.0.exe"2⤵
- Executes dropped EXE
PID:5112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
318KB
MD591a5a9d7570e04cb9497e1e6b71eba4c
SHA14ea781e446576578578e9f7e73a0110913a8b62b
SHA256bd4f6a49bdd252e0a06b14edbc607fb9dd1e734b86d73bbf4858ce746763630d
SHA5125b61a1ee15244dd26175b0ab5b96c032622ba5fbce0adda1edc2be30bde2030d8b31b78afbe51322a0c583604c84a1cd2068c4ec9dde0d87f65c60a7b5033cef