Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe
Resource
win10v2004-20240508-en
General
-
Target
a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe
-
Size
13.1MB
-
MD5
e66923a6bbcc8896fc852de46ea75f33
-
SHA1
4e34a67dd23627a4f630434acf8e3d7abaf756c4
-
SHA256
a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7
-
SHA512
0cc89f81920783edc7f91d76359aad3dd428c7d9971bd7bdf87e450e92e808268b869fe52254ede7649eefa7377124bc7b948ca5dc50fe370d49df3031d88a78
-
SSDEEP
196608:z89duCvh7pQoXhQET1AIxGJYJbaogx2g4NI:Ouy7p7XhN5aaHgYg
Malware Config
Signatures
-
Loads dropped DLL 4 IoCs
pid Process 2948 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 2948 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 2296 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 2296 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\font_temp.ttf a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe File opened for modification C:\Windows\Fonts\font_temp.ttf a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2724 PING.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2948 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 2948 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 2296 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 2296 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2948 wrote to memory of 60 2948 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 81 PID 2948 wrote to memory of 60 2948 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 81 PID 2948 wrote to memory of 60 2948 a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe 81 PID 60 wrote to memory of 2724 60 cmd.exe 83 PID 60 wrote to memory of 2724 60 cmd.exe 83 PID 60 wrote to memory of 2724 60 cmd.exe 83 PID 60 wrote to memory of 2296 60 cmd.exe 86 PID 60 wrote to memory of 2296 60 cmd.exe 86 PID 60 wrote to memory of 2296 60 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe"C:\Users\Admin\AppData\Local\Temp\a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Restart.bat2⤵
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\a735cf00d4350d0585da971e554af1dcc4e2b164249fc0fc711ae452c5a42ac7.exe"C:\Users\Admin\AppData\Local\Temp\A735CF~1.EXE"3⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2296
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5a1df3b7884c175c967505a589ba51da2
SHA17aaf570e41a00149134973d00f4efc09c4b650c2
SHA256c16014329cf6f242a525f6782dd10f6a4d0ff6f97239710fdc45522f5c6da525
SHA51212b8bd05fd9bec79d643edb503634b8b5238c67c77ddd8d2c3220406c08b1e6197e8aff02c709e353bc4ce9353a6709837b81ca443660250d94e73c00d66f451
-
Filesize
113B
MD56ba1cb710deb28eee9582758d8ad7fc1
SHA19d26ac9e6791115b64ae37a3ee2db894bd57f73e
SHA256ebac4528f4fc02a6f327a30d6c11335aeeba57dba8a5ecfb305df53f30bc407b
SHA51252b52594fcb0a62ed390659ac61307d0fe0a1af00ad514dd787050a177e243d6104869b6f3098842d2baffa35d6f50744e4ff9e930af3593a5f8dd690837640f
-
Filesize
333KB
MD556a2bcecbd3cddd6f4a35361bf4920d6
SHA1992e63be423f0e61093ba183f49fc0cbec790488
SHA2565fcfac18758a12e0e717a5189f379922a32b5ac12f26491e638d70b54ae1dcab
SHA512473cbdf760242db1f0f1d0c27046c0564998f2bf931ad03feb28af3c7bd253d00e6f0836dadf37f29e0db4171eb64e6a15ed4cb9a9d28b48fb0aab601573f551
-
Filesize
8.0MB
MD5092a99ee52bbaef7481cc96c5b85b992
SHA106b8475f99605af9ff9ff3ed1d0eb907fd57c06b
SHA256b3f675ccfc65edd6f27432dec6639b1414e9dc627831791263a99e2d711d215d
SHA5123538cebe1c0e2439c7ba289c4420627d59b4922e26242408f114aa01d342734b057d92edac35bee7c47cb926091695efc6c560802db0cd342f75cee1f8b96baf