Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    30/04/2024, 08:01

General

  • Target

    c19a79831c14775cf142f2b88daf1e9fcf3b11188dfcc472c28d05e9f0bc2be6.exe

  • Size

    2.4MB

  • MD5

    59577da5fa1d77da005b97bf44bf4c6f

  • SHA1

    c5064679fe7934c7f86b2732d502191ba3559f55

  • SHA256

    c19a79831c14775cf142f2b88daf1e9fcf3b11188dfcc472c28d05e9f0bc2be6

  • SHA512

    d0bcc9d716cd75046b348b4a7cf867c1935a5e1725bb4539b6255d68bba461dbc3d845beb17e535615d92c1219f35cea7107d20f67589b8dbbb3a4dbc325a95e

  • SSDEEP

    49152:yVz7tX+Eyrh2I1jvZSK1913lN21qrMSRkqrY3NEB1gh/aab/u2pTLg2wec+6:yVzEEmpr91VEQkoANEMYA/u2G46

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c19a79831c14775cf142f2b88daf1e9fcf3b11188dfcc472c28d05e9f0bc2be6.exe
    "C:\Users\Admin\AppData\Local\Temp\c19a79831c14775cf142f2b88daf1e9fcf3b11188dfcc472c28d05e9f0bc2be6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:680
    • C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" gNBU.aQ /u /s
      2⤵
      • Loads dropped DLL
      PID:2324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gNBU.aQ

    Filesize

    2.0MB

    MD5

    55677b68f7e1a3941580426805526224

    SHA1

    5a9a8d3e8bc43ae87e1f7af09470651901c4adec

    SHA256

    c0cc9379479699dc050a20c1e275f10ba418232b71ad8e7dfa47158133d7ebc8

    SHA512

    a9dcab4a3149028ececd2bfe514f2ef831b9a3263183c9206241a68095fce57d29cbb6f8b24a76aeadb8b1d8c1ac53f751c69f976df669c36c096e331798da05

  • memory/2324-6-0x0000000000BC0000-0x0000000000BC6000-memory.dmp

    Filesize

    24KB

  • memory/2324-4-0x0000000010000000-0x00000000101FE000-memory.dmp

    Filesize

    2.0MB

  • memory/2324-7-0x0000000002710000-0x0000000002838000-memory.dmp

    Filesize

    1.2MB

  • memory/2324-8-0x0000000002840000-0x000000000294C000-memory.dmp

    Filesize

    1.0MB

  • memory/2324-11-0x0000000002840000-0x000000000294C000-memory.dmp

    Filesize

    1.0MB

  • memory/2324-12-0x0000000010000000-0x00000000101FE000-memory.dmp

    Filesize

    2.0MB

  • memory/2324-14-0x0000000002840000-0x000000000294C000-memory.dmp

    Filesize

    1.0MB

  • memory/2324-15-0x0000000002950000-0x0000000003065000-memory.dmp

    Filesize

    7.1MB

  • memory/2324-16-0x0000000003070000-0x000000000316E000-memory.dmp

    Filesize

    1016KB

  • memory/2324-17-0x0000000003170000-0x000000000327A000-memory.dmp

    Filesize

    1.0MB

  • memory/2324-18-0x0000000003170000-0x000000000327A000-memory.dmp

    Filesize

    1.0MB

  • memory/2324-20-0x0000000003170000-0x000000000327A000-memory.dmp

    Filesize

    1.0MB

  • memory/2324-21-0x0000000000390000-0x0000000000392000-memory.dmp

    Filesize

    8KB

  • memory/2324-22-0x0000000031410000-0x0000000031414000-memory.dmp

    Filesize

    16KB