Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2024, 00:13

General

  • Target

    83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe

  • Size

    5.4MB

  • MD5

    773ccd588fe6945616e45c19bf13490f

  • SHA1

    c81058b04f40e87cf21469b567f53bcb8b290de0

  • SHA256

    83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720

  • SHA512

    07909a12833d21c7a2a1173cd8201a551fccbfc6347131dea62b5d4610528f4e319d74284959755fd203d87433a3d6ba881319dee6e477413ef3195f795d8a52

  • SSDEEP

    98304:emhd1UryeZqKsSzbyXDZPheE0V7wQqZUha5jtSyZIUh:elEKtkUE02QbaZtliU

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe
    "C:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2840
    • C:\Users\Admin\AppData\Local\Temp\43A0.tmp
      "C:\Users\Admin\AppData\Local\Temp\43A0.tmp" --splashC:\Users\Admin\AppData\Local\Temp\83c7b80ed36389b064931a08e4d6f5ec9ff8bbc78b8a00ceb3e2a46fed047720.exe 765E6AAD439EDB17549EEB1ABE8FA048314CBFDDB7AF88E11B9BDCE40BD94193D1C6318E41C435017F2F5278D11BD67662DCEB28C0FEC2F513C3EDF8B23922AD
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\43A0.tmp

    Filesize

    5.4MB

    MD5

    e7d5b2205ba7e7a950cab63c24cb24f0

    SHA1

    7882116fe11cdd3d27c252c2025baa180a14669c

    SHA256

    692798f4b10250e0977b5436a1808493535fa9c3b6d3b2f28c16895deac3796b

    SHA512

    9b79849beefc9304e3dd19d72c4152f7ba8cbf59c8e492b23b5c2387278a2f68f08defac4a9624f63650d673de9fbf8b4ee84509d0ccb2b8829bbef4fc2c674e

  • memory/2308-5-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB

  • memory/2840-0-0x0000000000400000-0x0000000000849000-memory.dmp

    Filesize

    4.3MB