Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 23:05
Static task
static1
Behavioral task
behavioral1
Sample
7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
Resource
win10v2004-20240226-en
General
-
Target
7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
-
Size
29KB
-
MD5
ae6b03bdbe142dfc9e337415b4a0fed7
-
SHA1
50a1c6a4a11fed85dc1441320e52881b757c2b22
-
SHA256
7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663
-
SHA512
50aeb2acf43b3ed470ae39b7d8c5b68fd524489355a56e71e91d16905e8e41e2ddae35e3f20922e9fe5a757e9a6e10b1f6eef93c5736b4a3226fa4889005ba00
-
SSDEEP
384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXLs:v/qSamrxDmqoKM4Z0iwtwALs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4644 2024061423.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4284 7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe 4644 2024061423.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4284 wrote to memory of 4644 4284 7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe 90 PID 4284 wrote to memory of 4644 4284 7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe 90 PID 4284 wrote to memory of 4644 4284 7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe 90 PID 4284 wrote to memory of 5068 4284 7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe 91 PID 4284 wrote to memory of 5068 4284 7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe 91 PID 4284 wrote to memory of 5068 4284 7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe"C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\2024061423.exeC:\Users\Admin\AppData\Local\Temp\2024061423.exe down2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4644
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat2⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵PID:824
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
29KB
MD5eb3ea22d4d30ac08d71137cb9c99bdc0
SHA17f17f6faca98534fc2e072f9e6c9428f71df14f9
SHA256d0496d69d7f95c1ec9e51c6404d3a4206e528f90093a8d0f512c6bacf8891472
SHA5129bc5466ea1247d3615387341734607933e72cde2208edad6f662263b40e14df4cd7d35163cf97f443ccc7cc65b3989105d87dc55cb51563edd45553f93086878
-
Filesize
267B
MD5669a3ff7732aa82dcac8feb22e100747
SHA1325a54698630a8e3801d7667658144412a034f4c
SHA25678d4566ca95d3a0d89a2b619a6561f4b3bb25463c045d32a05fce9150dba9a67
SHA512ca45d694ec59ca46cbf7532f54841edc5aae788cf297cf26ae3baf4c70c986b1417028615db817979097a1b011869374cd64e1ce669b131a7850771de5b97db4