Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 09:22
Static task
static1
Behavioral task
behavioral1
Sample
836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe
Resource
win10v2004-20240508-en
General
-
Target
836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe
-
Size
6.8MB
-
MD5
66ed92f0c82f96158505be458b930089
-
SHA1
e574e64e004e41ebd3e8458c5ab62c9ccef036d7
-
SHA256
836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb
-
SHA512
7a3a409def0d09117f23707943133bfece08497c9dacade605feae012d4e4b65e0b9d8b0f58e11e6ba155d458ee5af2b19899c2e4e59b05f8c8778b6b15cc706
-
SSDEEP
98304:LDvPIbilG4fUJB/nKTvAxJdNYcq/NY0B8gc6cZjWt+Z//37ibd4s6uipukP:oVJBfHxn6x6ILc6k2+ZHrhs65
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 928 aria2c.exe -
resource yara_rule behavioral2/files/0x00070000000233b7-21.dat upx behavioral2/memory/928-23-0x0000000000400000-0x00000000008B0000-memory.dmp upx behavioral2/memory/928-25-0x0000000000400000-0x00000000008B0000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3956 wrote to memory of 1688 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe 80 PID 3956 wrote to memory of 1688 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe 80 PID 3956 wrote to memory of 1688 3956 836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe 80 PID 1688 wrote to memory of 928 1688 cmd.exe 82 PID 1688 wrote to memory of 928 1688 cmd.exe 82 PID 1688 wrote to memory of 928 1688 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe"C:\Users\Admin\AppData\Local\Temp\836a62a3b16794089600564270b7c8e866aeb7fff16188eb2b9c1ad581c4b6eb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\SysWOW64\cmd.execmd /c cd download&aria2c.exe --conf-path ./aria2.conf --check-certificate=false --disable-ipv6=false --enable-rpc=true --rpc-allow-origin-all=true --rpc-listen-all=true --rpc-listen-port 6288 --listen-port 6388 --dht-listen-port 6390 --enable-dht=true --enable-dht6=true --dht-file-path=./dht.dat --dht-file-path6=./dht6.dat --quiet=true --stop-with-process=39562⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\download\aria2c.exearia2c.exe --conf-path ./aria2.conf --check-certificate=false --disable-ipv6=false --enable-rpc=true --rpc-allow-origin-all=true --rpc-listen-all=true --rpc-listen-port 6288 --listen-port 6388 --dht-listen-port 6390 --enable-dht=true --enable-dht6=true --dht-file-path=./dht.dat --dht-file-path6=./dht6.dat --quiet=true --stop-with-process=39563⤵
- Executes dropped EXE
PID:928
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5d08f927d8a53cc5a7b97515318d126ad
SHA1124d281c70d345566cc85a4680a993b754d2007e
SHA25607e07944a526a7e9fb60bfedef59189b5950946f5a39b6df36de8ab74abf8729
SHA512e90abf11942e3dd261039a4d9876659ec69a6099005c0f321e426d3de9ab20feb7b0105e98e7bc7747548ed4edfbb82bb0bc11c9d262e4db829aeb26ef1461bf
-
Filesize
1.8MB
MD56d1fe9171538df42e013e6ecf330ec48
SHA1a85203e77419c484a4434d56f96a0404b73ec588
SHA256ef342516f4e2c211cd70cef033e558d598229c75e39292b668ae4ea7bf09eafe
SHA5126603d1a60aa610c3269f9592877ef1a56f4dfe0f2496c017434ae1074fe8c3d0348386316129607d5dc09af1e7ae35f67e12fd72131652dc95e308b5581e1fbd