Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 12:38

General

  • Target

    BH2002/RegSetup.exe

  • Size

    40KB

  • MD5

    38ca09b8a5e555ecf188415184fdb7ad

  • SHA1

    becbda94c1b8952f21fa60e0bdf4ff2c70a126a3

  • SHA256

    365d4a97c265c4587aec4234c7913d8f7bdce3f3d51dfc4d7a53b28285c37ede

  • SHA512

    721933be9bc4f7863c603653b6286074929952f1cf8ba4dfeee756f0a8c045b7314bedfeb94ad0591e38d40b29b5c14002d37d2994b0caf0c90d51e3d65b5af0

  • SSDEEP

    384:2pkyMFml9CIxTEVS6NwyM8ww6yWtsnoap6y+HM3J/wYJraWmo0WI2OBKdQmyhE:21rNEV1wDwznoawx4JokrPmoLbOur

Score
1/10

Malware Config

Signatures

  • Runs regedit.exe 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BH2002\RegSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\BH2002\RegSetup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3600
    • C:\Windows\SysWOW64\regedit.exe
      /s C:\Users\Admin\AppData\Local\Temp\cls3C1E.tmp
      2⤵
      • Runs regedit.exe
      PID:5104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\cls3C1E.tmp

    Filesize

    214B

    MD5

    49b0c13c4d1ab5773eccdc8aabd148dc

    SHA1

    328e2f7490ccbe8f3957fefdc53f22102d13378d

    SHA256

    dbaa23358bb88a9ddd96d25a10bd3d4c59d5af664e046ace9b9568e260b1061c

    SHA512

    f4aecb02c022841d22ade238ce13a985feba61b169168e08d7361521fafab5a8737d701fc0609bdd40ac049be793f706b2c9adc936a13347e6659cae9fbae51d