Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
0f38edbf83ba0f3293348a875272bf50N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
0f38edbf83ba0f3293348a875272bf50N.exe
Resource
win10v2004-20240709-en
General
-
Target
0f38edbf83ba0f3293348a875272bf50N.exe
-
Size
7.8MB
-
MD5
0f38edbf83ba0f3293348a875272bf50
-
SHA1
62d1bad5a6639879ea911c87ded1fd4f8a314130
-
SHA256
1b120f48761837a08fd5790e138efcf4de7cf8150d0a457199ea933eca7d1696
-
SHA512
0aa4ddf3d2fd8ab79c401b30a2da4464b90ebdfd92e905fab030c32765a73887b18f14bfe617549f6ad5826a19bc933a541565fbbcfca7f05d4b109c7ca13081
-
SSDEEP
196608:W288p8RT3OgtMwVajd4nXhE7OUGCZvb+CV4i8JRzY6SK:W288+T3O6I2nXhE7OUGClb+CV4vD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3348 setup.exe -
Loads dropped DLL 3 IoCs
pid Process 3348 setup.exe 3348 setup.exe 3348 setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2384 wrote to memory of 3348 2384 0f38edbf83ba0f3293348a875272bf50N.exe 84 PID 2384 wrote to memory of 3348 2384 0f38edbf83ba0f3293348a875272bf50N.exe 84 PID 2384 wrote to memory of 3348 2384 0f38edbf83ba0f3293348a875272bf50N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f38edbf83ba0f3293348a875272bf50N.exe"C:\Users\Admin\AppData\Local\Temp\0f38edbf83ba0f3293348a875272bf50N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\7zS059CA6A7\setup.exe.\setup.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD598b7ff04d271a6456ff75695569d0131
SHA1615b1d967e0432bc9314cb62b1a900f2068ad8b2
SHA2569be23da2b8505180a1f94520dab6e6a741dbe961520bf4ae1eb6a0e68d1f811d
SHA5128f5cdec901ed1586f5e888cc2aeac985545d3c2719b80de671003b4b275ce7b0460a0c4744c1ef5a2210ee52f41566c54333ca91d411d22154370e81f62ba94a
-
Filesize
12KB
MD5192639861e3dc2dc5c08bb8f8c7260d5
SHA158d30e460609e22fa0098bc27d928b689ef9af78
SHA25623d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
SHA5126e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
-
Filesize
13KB
MD53fa5491c158c30082b42569cf4f54381
SHA1a2d92f2c7a1b7c468ab14bd3ae03e2574baebc1a
SHA256560ba0a768687a5b8643062b6183991e4d8e172b870e3c0a8a8847043ce32c86
SHA512d12c67773d21cc8e827685feeb5805ca421ff1f5826471739909d6785d33b7ea21f41289ba063d58205918099efd4464523d8f90558f647e182d4cefb156d10a
-
Filesize
9KB
MD5b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA115ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA25689a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
SHA5126467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8