Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 23:05

General

  • Target

    7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe

  • Size

    29KB

  • MD5

    ae6b03bdbe142dfc9e337415b4a0fed7

  • SHA1

    50a1c6a4a11fed85dc1441320e52881b757c2b22

  • SHA256

    7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663

  • SHA512

    50aeb2acf43b3ed470ae39b7d8c5b68fd524489355a56e71e91d16905e8e41e2ddae35e3f20922e9fe5a757e9a6e10b1f6eef93c5736b4a3226fa4889005ba00

  • SSDEEP

    384:v/4LNJY74JwOllSBQmrb0i5PrmqHIKpa54b5f0iws0wGXLs:v/qSamrxDmqoKM4Z0iwtwALs

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe
    "C:\Users\Admin\AppData\Local\Temp\7cc58fedce9222ebd08b8e22b8fe3a75293c2f58a60cd34ebadd60c2c95df663.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\2024061423.exe
      C:\Users\Admin\AppData\Local\Temp\2024061423.exe down
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4644
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\del.bat
      2⤵
        PID:5068
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:824

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\2024061423.exe

        Filesize

        29KB

        MD5

        eb3ea22d4d30ac08d71137cb9c99bdc0

        SHA1

        7f17f6faca98534fc2e072f9e6c9428f71df14f9

        SHA256

        d0496d69d7f95c1ec9e51c6404d3a4206e528f90093a8d0f512c6bacf8891472

        SHA512

        9bc5466ea1247d3615387341734607933e72cde2208edad6f662263b40e14df4cd7d35163cf97f443ccc7cc65b3989105d87dc55cb51563edd45553f93086878

      • C:\Users\Admin\AppData\Local\Temp\del.bat

        Filesize

        267B

        MD5

        669a3ff7732aa82dcac8feb22e100747

        SHA1

        325a54698630a8e3801d7667658144412a034f4c

        SHA256

        78d4566ca95d3a0d89a2b619a6561f4b3bb25463c045d32a05fce9150dba9a67

        SHA512

        ca45d694ec59ca46cbf7532f54841edc5aae788cf297cf26ae3baf4c70c986b1417028615db817979097a1b011869374cd64e1ce669b131a7850771de5b97db4

      • memory/4644-14-0x0000000000400000-0x0000000000408000-memory.dmp

        Filesize

        32KB