Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
20/07/2024, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
4029ef5c22e407db8d5ff6c5f1286600N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4029ef5c22e407db8d5ff6c5f1286600N.exe
Resource
win10v2004-20240709-en
General
-
Target
4029ef5c22e407db8d5ff6c5f1286600N.exe
-
Size
716KB
-
MD5
4029ef5c22e407db8d5ff6c5f1286600
-
SHA1
8a39a6d1d817bcaff5e4fd84f9b6c2e1615387a6
-
SHA256
03e8ac968df7b058ac4c5e546dec7e2403071562a9033ba8da2c88d1ece45fac
-
SHA512
7225ea684c5d25f7c1661cdad7d9601280454bcde42eae87ee616f5f52e207b5bbc13351f8e4696e0148ce27cff83bfbfa48f1d02a635d8785b04ac6fb63687f
-
SSDEEP
12288:v2Ut4GIHGniMbq3VMDdybH1fsU4JTmVFiY5HxPScqKvnY3QyunoYcS5KT:v2U7IHGrq+DYZKOiax8YaXa6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1444 4029ef5c22e407db8d5ff6c5f1286600N.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4628 wrote to memory of 1444 4628 4029ef5c22e407db8d5ff6c5f1286600N.exe 84 PID 4628 wrote to memory of 1444 4628 4029ef5c22e407db8d5ff6c5f1286600N.exe 84 PID 4628 wrote to memory of 1444 4628 4029ef5c22e407db8d5ff6c5f1286600N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\4029ef5c22e407db8d5ff6c5f1286600N.exe"C:\Users\Admin\AppData\Local\Temp\4029ef5c22e407db8d5ff6c5f1286600N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\is-EG460.tmp\4029ef5c22e407db8d5ff6c5f1286600N.tmp"C:\Users\Admin\AppData\Local\Temp\is-EG460.tmp\4029ef5c22e407db8d5ff6c5f1286600N.tmp" /SL5="$5028C,497037,53248,C:\Users\Admin\AppData\Local\Temp\4029ef5c22e407db8d5ff6c5f1286600N.exe"2⤵
- Executes dropped EXE
PID:1444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
669KB
MD552950ac9e2b481453082f096120e355a
SHA1159c09db1abcee9114b4f792ffba255c78a6e6c3
SHA25625fbc88c7c967266f041ae4d47c2eae0b96086f9e440cca10729103aee7ef6cd
SHA5125b61c28bbcaedadb3b6cd3bb8a392d18016c354c4c16e01395930666addc95994333dfc45bea1a1844f6f1585e79c729136d3714ac118b5848becde0bdb182ba