Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
31/05/2024, 07:48
General
-
Target
2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
acac9ad34601095c592961ac89917849
-
SHA1
c35db2b7ddbaeb5efbf80e07799916cbe907bf23
-
SHA256
5b1d2aef92b03359fa09d8e93cb2eb5ac14ce5485f00f741b13a8395220299df
-
SHA512
b17368fecc3c0a1162953dfd84b4db691d30390886b7c3ac3fbd659f88ed3dad8b355bef9402aeabeec8993e3ed2c4f4d2302c4e2b7915ede4fd2fcf11f2e74d
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Nb:DBIKRAGRe5K2UZn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-31_acac9ad34601095c592961ac89917849_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574314.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e574314.exe 2405998432⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 20723⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4740 -ip 47401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5e0def8228135fa3bb614470896d89f5d
SHA177182eb43cb424f56b26879d9c34a5c8b7271efb
SHA256dac5d82c39231f239c012fbcf8b7c79a3dd08a46b2f3e29719bf55cffc9e6021
SHA512048826db14f8c2ec3fbf65e20d1b368cfe88bdfec25d472cd43e767b5307658b97485f96a58cd9a5ae100ded6b00e6185110f0fcc10c2e5af65127c7e0691c25
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB