Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 12:59
Static task
static1
Behavioral task
behavioral1
Sample
4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe
Resource
win10v2004-20240508-en
General
-
Target
4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe
-
Size
7.8MB
-
MD5
44b2b48c3729f8435cf18f0e98a06e4e
-
SHA1
b5adfc5cfcf89f66c9b0abe8a1826731fa5e24f6
-
SHA256
4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083
-
SHA512
c955e35aee0844b1fc410f4c53e36f1f0d0e3e87845784ad0f7fc8f9786313e5e88a1889bde458ca8d0cb0eb4bde97d75a20c25374b5f5874d479f37a7fc56a4
-
SSDEEP
98304:emhd1Uryes1nrMis71O3SeyK8dV7wQqZUha5jtSyZIUb:elM1rts71Od8d2QbaZtli
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2380 421A.tmp -
Executes dropped EXE 1 IoCs
pid Process 2380 421A.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4296 wrote to memory of 2380 4296 4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe 85 PID 4296 wrote to memory of 2380 4296 4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe 85 PID 4296 wrote to memory of 2380 4296 4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe"C:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp" --splashC:\Users\Admin\AppData\Local\Temp\4aa087520aedc2a3738613988631a85c2db89408d8da4f24bf46be74457f8083.exe CDFC13375DBED68A492C633E0E3C73D4EFB522985354914CD165F5BBF2848A756660ED6BC10F22FC9CE502E9E7C7D2624AE6380723B965D639C238C3369197A72⤵
- Deletes itself
- Executes dropped EXE
PID:2380
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.8MB
MD5742f0b8f080980a9f87bff5fb94d9698
SHA126265ee4f6834dccef01e9e4b2d51a14274c4a28
SHA25648fec8efdcb64ed1178405d385d9304a05a50bb99c11935b31a827f31d39a8bb
SHA51256a9c9f1ba0b53c9a4b005cb4bd2c731b9c6f973705ef8057c5442466a6f9e77ab723dc30a67b315470fed8b06eee0aee38788d3aff9c8c51a2fa802ff392119