Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
19/06/2024, 20:31
General
-
Target
2024-06-19_ae2863f255bf3743c1b46f72f7573b7b_hacktools_xiaoba.exe
-
Size
3.2MB
-
MD5
ae2863f255bf3743c1b46f72f7573b7b
-
SHA1
e946146f630bcbda27b84212d78f0ab1057bd4c6
-
SHA256
2988ed74b1814b0d04f80f10edd7bd6b51992963c6d68167df412086f78fd0c3
-
SHA512
0685a4420c4708ae632ce85f0e4b12ec18f81b48d979d98cc7896cbdb05861384df2de52496564137b875b33bf8452ea09611a8d9e62718900c45586e6a67724
-
SSDEEP
49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1NF:DBIKRAGRe5K2UZJ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-19_ae2863f255bf3743c1b46f72f7573b7b_hacktools_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-19_ae2863f255bf3743c1b46f72f7573b7b_hacktools_xiaoba.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572d78.exeC:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e572d78.exe 2405942962⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 20723⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3880 -ip 38801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD52a2270d6b8555672c2f4c2e23a48525a
SHA18f80aaf500cf42020579d03fdc35dd39662b5720
SHA256fc81321dcb5f1ead46316b8904e45095c5577e7a91ccdd22be5fd627276f49f6
SHA5125383b7ae439b3abbd65d5d0c89753bb42765b7cea2bf225a05207fb9f2898b6684430d9437bf37a4abd5ab436db05e1598f882b5fc9abec98f4343cdb253d003
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
3.6MB