Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 19:32
Behavioral task
behavioral1
Sample
212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe
Resource
win10v2004-20240426-en
General
-
Target
212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe
-
Size
5.7MB
-
MD5
008b1c8c35a686911728b7a4801ce533
-
SHA1
3b4d78ad91de2e9d901e55c760df1b1fe8683114
-
SHA256
212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9
-
SHA512
755bf055113e6c0e886bf779d5b1ebdc44f83f5447aad62f2e58ffc315123839a9fa7af69ed53ccc905b1e299a8025be6e3cab7eeb065890d9b5f13ca3e5a70b
-
SSDEEP
98304:llaCCCCCCCCCCCCCCCCCCCCCCCCCCCCCHffffffffffffffffffffffffffffffF:lQCCCCCCCCCCCCCCCCCCCCCCCCCCCCCl
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023283-3.dat UPX behavioral2/memory/5100-4-0x0000000000400000-0x000000000042A000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
pid Process 5100 svrwsc.exe -
resource yara_rule behavioral2/files/0x0007000000023283-3.dat upx behavioral2/memory/5100-4-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\svrwsc.exe 212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe File created C:\Windows\SysWOW64\svrwsc.exe svrwsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe"C:\Users\Admin\AppData\Local\Temp\212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe"1⤵
- Drops file in System32 directory
PID:3592
-
C:\Windows\SysWOW64\svrwsc.exeC:\Windows\SysWOW64\svrwsc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5100
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD56ad1da63bdc6dde20d9097f199cbfd33
SHA111a1a6424d90e2c5cd5ceeb29d4d8c7468cfdc62
SHA2567d35fb94980ce24abca53da8c8bddeb8e75f0d1bbf6a8ba477bb422bf34c261b
SHA5129e9b8fad03b48be543ea2b0b5c4b1dec1d9a9b23020817b7688bbd0b75838d80f05d59d86baac98ca56304e029acbfea9bd9b04bb9e9665c1e3cbf35f77f8c07