Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 16:22

General

  • Target

    a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe

  • Size

    13.1MB

  • MD5

    e66923a6bbcc8896fc852de46ea75f33

  • SHA1

    4e34a67dd23627a4f630434acf8e3d7abaf756c4

  • SHA256

    a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7

  • SHA512

    0cc89f81920783edc7f91d76359aad3dd428c7d9971bd7bdf87e450e92e808268b869fe52254ede7649eefa7377124bc7b948ca5dc50fe370d49df3031d88a78

  • SSDEEP

    196608:z89duCvh7pQoXhQET1AIxGJYJbaogx2g4NI:Ouy7p7XhN5aaHgYg

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe
    "C:\Users\Admin\AppData\Local\Temp\a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Restart.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:60
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 2
        3⤵
        • Runs ping.exe
        PID:2724
      • C:\Users\Admin\AppData\Local\Temp\a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe
        "C:\Users\Admin\AppData\Local\Temp\A735CF~1.EXE"
        3⤵
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:2296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ExuiKrnln_Win32_20230819.lib

    Filesize

    1.6MB

    MD5

    a1df3b7884c175c967505a589ba51da2

    SHA1

    7aaf570e41a00149134973d00f4efc09c4b650c2

    SHA256

    c16014329cf6f242a525f6782dd10f6a4d0ff6f97239710fdc45522f5c6da525

    SHA512

    12b8bd05fd9bec79d643edb503634b8b5238c67c77ddd8d2c3220406c08b1e6197e8aff02c709e353bc4ce9353a6709837b81ca443660250d94e73c00d66f451

  • C:\Users\Admin\AppData\Local\Temp\Restart.bat

    Filesize

    113B

    MD5

    6ba1cb710deb28eee9582758d8ad7fc1

    SHA1

    9d26ac9e6791115b64ae37a3ee2db894bd57f73e

    SHA256

    ebac4528f4fc02a6f327a30d6c11335aeeba57dba8a5ecfb305df53f30bc407b

    SHA512

    52b52594fcb0a62ed390659ac61307d0fe0a1af00ad514dd787050a177e243d6104869b6f3098842d2baffa35d6f50744e4ff9e930af3593a5f8dd690837640f

  • C:\Users\Admin\AppData\Local\Temp\e578c13.tmp

    Filesize

    333KB

    MD5

    56a2bcecbd3cddd6f4a35361bf4920d6

    SHA1

    992e63be423f0e61093ba183f49fc0cbec790488

    SHA256

    5fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab

    SHA512

    473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551

  • C:\Users\Admin\AppData\Local\Temp\font_temp.ttf

    Filesize

    8.0MB

    MD5

    092a99ee52bbaef7481cc96c5b85b992

    SHA1

    06b8475f99605af9ff9ff3ed1d0eb907fd57c06b

    SHA256

    b3f675ccfc65edd6f27432dec6639b1414e9dc627831791263a99e2d711d215d

    SHA512

    3538cebe1c0e2439c7ba289c4420627d59b4922e26242408f114aa01d342734b057d92edac35bee7c47cb926091695efc6c560802db0cd342f75cee1f8b96baf

  • memory/2296-35-0x0000000061080000-0x0000000061119000-memory.dmp

    Filesize

    612KB