Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
01/05/2024, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe
Resource
win10v2004-20240419-en
General
-
Target
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe
-
Size
5.4MB
-
MD5
773ccd588fe6945616e45c19bf13490f
-
SHA1
c81058b04f40e87cf21469b567f53bcb8b290de0
-
SHA256
83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720
-
SHA512
07909a12833d21c7a2a1173cd8201a551fccbfc6347131dea62b5d4610528f4e319d74284959755fd203d87433a3d6ba881319dee6e477413ef3195f795d8a52
-
SSDEEP
98304:emhd1UryeZqKsSzbyXDZPheE0V7wQqZUha5jtSyZIUh:elEKtkUE02QbaZtliU
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2308 43A0.tmp -
Executes dropped EXE 1 IoCs
pid Process 2308 43A0.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2308 2840 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 85 PID 2840 wrote to memory of 2308 2840 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 85 PID 2840 wrote to memory of 2308 2840 83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe"C:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 765E6AAD439EDB17549EEB1ABE8FA048314CBFDDB7AF88E11B9BDCE40BD94193D1C6318E41C435017F2F5278D11BD67662DCEB28C0FEC2F513C3EDF8B23922AD2⤵
- Deletes itself
- Executes dropped EXE
PID:2308
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.4MB
MD5e7d5b2205ba7e7a950cab63c24cb24f0
SHA17882116fe11cdd3d27c252c2025baa180a14669c
SHA256692798f4b10250e0977b5436a1808493535fa9c3b6d3b2f28c16895deac3796b
SHA5129b79849beefc9304e3dd19d72c4152f7ba8cbf59c8e492b23b5c2387278a2f68f08defac4a9624f63650d673de9fbf8b4ee84509d0ccb2b8829bbef4fc2c674e