Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2024, 23:26
Static task
static1
Behavioral task
behavioral1
Sample
7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe
Resource
win10v2004-20240426-en
General
-
Target
7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe
-
Size
79KB
-
MD5
0dbbdfb374a6b5863ac3dc6dd6e09f12
-
SHA1
b93cc5c0b6361c96fa4df88823bf37f1272d65c5
-
SHA256
7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5
-
SHA512
d4184d79bba98609736769f7600aa58ba681b0fec817a0808cf2ab75c3beaaec9c814d14677381164e773b56fc8ae129e17d1f10cffc8eb3475daa2270ca2edf
-
SSDEEP
1536:zvANfA7voIfaFOQA8AkqUhMb2nuy5wgIP0CSJ+5ydB8GMGlZ5G:zvANfvi9GdqU7uy5w9WMydN5G
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4848 [email protected] -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2748 wrote to memory of 5052 2748 7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe 86 PID 2748 wrote to memory of 5052 2748 7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe 86 PID 2748 wrote to memory of 5052 2748 7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe 86 PID 5052 wrote to memory of 4848 5052 cmd.exe 87 PID 5052 wrote to memory of 4848 5052 cmd.exe 87 PID 5052 wrote to memory of 4848 5052 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe"C:\Users\Admin\AppData\Local\Temp\7a21d91fd51fc2c929c50b61b858a40943619c7451588b235b020fb89dbae3d5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\cmd.exePID:5052
-
C:\Users\Admin\AppData\Local\Temp\[email protected]PID:4848
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize79KB
MD5871c5fb9115e010ff5606b07b60340fb
SHA19aa6432a4ba263430491b799e2a03daf9e085f8d
SHA2563b53b119e19e7c21082328a342b9ec1514efbe797bf602a01e7975cda8a36017
SHA512f02ba3ddda3be2f2338852cc3981bad9a24081d8aac73a753d3bc1d10ed0486d6fa27a69d9ed36d041831a3946058bbac116cd280e88630b60d7432c842f6cb0