Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
14/05/2024, 01:23
General
-
Target
2024-05-14_f22bba182f4d8b772a7242d2d7bbfc22_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
f22bba182f4d8b772a7242d2d7bbfc22
-
SHA1
186e2662f72cca92bfe491980856c9a1305e0d5e
-
SHA256
949ffa1fe14a3cd6d0816fe6ad870b4abc6580c43289995ebb00085292ce370b
-
SHA512
27641f0dffa9387808f3ccbc1a7544c86834e73bca35d9e4930a4c1d23f36c95ed80755a8edb1f7f615f712539a3d2874a132f36de14ec314538921507e1afe3
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NR:DBIKRAGRe5K2UZd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-14_f22bba182f4d8b772a7242d2d7bbfc22_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-14_f22bba182f4d8b772a7242d2d7bbfc22_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57417d.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e57417d.exe 2405994212⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 20763⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3092 -ip 30921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5928ca322b50f09184a59c891356ee864
SHA1e38228549b99d7513417c59a1a771f67b84b15ca
SHA2568bc97e8972dc82a812228772a40636a53f87b59f4a40fd56d75485d472971180
SHA51286cde3d46fa80eb64936b335c35a6acb44446e317bc2850638126b8e24991735416465e319781fe4451fc4933e64df7dab25f4d5c674eaaef758c06c0f47527c
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB