Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
25/05/2024, 03:56
General
-
Target
2024-05-25_d4da04d17ba24e70509b71c4b1a51a2d_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
d4da04d17ba24e70509b71c4b1a51a2d
-
SHA1
8bac4020a4b7513aec111daca0e5e7a7fe9c02b5
-
SHA256
1f2db29c2cce3dd181134d1ee644faf07cc39ba079ce69152b45c4703b19f472
-
SHA512
7cb613be047f06f80304de4b429b98bf434194215204ae3a2ef54061183031551693363b9179b88e70fa6775207f075b7e738aec191f4234c42877e06161c10a
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NF:DBIKRAGRe5K2UZx
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_d4da04d17ba24e70509b71c4b1a51a2d_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_d4da04d17ba24e70509b71c4b1a51a2d_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e573a2a.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e573a2a.exe 2405975622⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2428 -s 20563⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2428 -ip 24281⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD574a1f4d1ae5916d8e6f1a7bce2f24ee3
SHA16e05db5a6cf0b43f82b3fc7fa7d9c52fd9021184
SHA2567928181f036645e8171233177f701c90091dcd89a930befbd41245d6645b9811
SHA512ca9e3edae7c157979c455db830a27288cb65f1159320b17b5151d965fa2c6c1e03e68060b5a005ab6197dbcbd601ff93ddcc0132f7e70ce468b6e6c86398e00b
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB