Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1744s
  • max time network
    1175s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 09:21

General

  • Target

    test-uQqOj.exe

  • Size

    48.5MB

  • MD5

    011e3528d69184ea3b4df07ddc097efd

  • SHA1

    83ce6f3d9bc022b18065b1c54b2c97256147871c

  • SHA256

    307c30ee4475b6be6536fdab68847793edb66409db5e77f64095d64dca886da0

  • SHA512

    83088b85102a8a92151e55b5d2f3bc20c2f68450f2d86d9cd4770d9bdb538f7a72030fef833e4712a55c2e1301f24685ce2a70441c785fd39b95ff74da29a347

  • SSDEEP

    786432:hDjtvjOVL3GXHnQS12Xyd/ZMjuqZYNGUEkSC3Asd0GCvOv3+fP/WLqolVdC6zva8:hDjgGXoljuTNGe3MGCvOvsolHadC6s

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test-uQqOj.exe
    "C:\Users\Admin\AppData\Local\Temp\test-uQqOj.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Users\Admin\AppData\Local\Temp\onefile_1532_133644720837961757\BackgroundTransferHost.exe
      "C:\Users\Admin\AppData\Local\Temp\test-uQqOj.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:1660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\onefile_1532_133644720837961757\BackgroundTransferHost.exe

    Filesize

    36.7MB

    MD5

    f8fad2b8b701489d5228939ceeffe16e

    SHA1

    fa8c427845b9b24ff890699fe5a4c06f4f3cb9db

    SHA256

    e3349dbfc115576db3c54160a75380e1bb9239f3d01e6f258e6c15b590b9fb78

    SHA512

    fc0368b613641a3585b356f589a9dd9d2e31a8af94748f20e7d21da8ae0adaeb45508a225d4bc9537c4d1239dc18ce4538cfee05be3cb786bafda8a09209295c

  • C:\Users\Admin\AppData\Local\Temp\onefile_1532_133644720837961757\VCRUNTIME140.dll

    Filesize

    95KB

    MD5

    f34eb034aa4a9735218686590cba2e8b

    SHA1

    2bc20acdcb201676b77a66fa7ec6b53fa2644713

    SHA256

    9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1

    SHA512

    d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af

  • C:\Users\Admin\AppData\Local\Temp\onefile_1532_133644720837961757\python310.dll

    Filesize

    4.3MB

    MD5

    63a1fa9259a35eaeac04174cecb90048

    SHA1

    0dc0c91bcd6f69b80dcdd7e4020365dd7853885a

    SHA256

    14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed

    SHA512

    896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b

  • memory/1532-177-0x00007FF610750000-0x00007FF6137E5000-memory.dmp

    Filesize

    48.6MB

  • memory/1660-93-0x00007FF78AEE0000-0x00007FF78D42B000-memory.dmp

    Filesize

    37.3MB