Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 01:48
Static task
static1
Behavioral task
behavioral1
Sample
418b39cd1b7e1176c41c0095f750a5f0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
418b39cd1b7e1176c41c0095f750a5f0N.exe
Resource
win10v2004-20240709-en
General
-
Target
418b39cd1b7e1176c41c0095f750a5f0N.exe
-
Size
762KB
-
MD5
418b39cd1b7e1176c41c0095f750a5f0
-
SHA1
01a1e59941533414082266a77217b676bda326ff
-
SHA256
c2a3d1da644441ae89be319262ac39f5b7113706b7080e8ea67fa6846782ec59
-
SHA512
8e4ec025daa78ebefa0861c5a1e51d375408f73ace8b2d03588bae1515564a06de621b4d5ed4d4f2fd24c621db65677d9caf13b31264ae3bdf026b1355471954
-
SSDEEP
12288:GPvpTfLNH1IJ5lzV8IfRZD8J3KGJYPkRGtRAax7LeR9tw0qlu3Ic5ayxOXjQyb8H:GPvJfbO5lxHfRZg3KkYPkRGtltLMku4m
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3560 418b39cd1b7e1176c41c0095f750a5f0N.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1952 wrote to memory of 3560 1952 418b39cd1b7e1176c41c0095f750a5f0N.exe 86 PID 1952 wrote to memory of 3560 1952 418b39cd1b7e1176c41c0095f750a5f0N.exe 86 PID 1952 wrote to memory of 3560 1952 418b39cd1b7e1176c41c0095f750a5f0N.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\418b39cd1b7e1176c41c0095f750a5f0N.exe"C:\Users\Admin\AppData\Local\Temp\418b39cd1b7e1176c41c0095f750a5f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\is-LT3SU.tmp\418b39cd1b7e1176c41c0095f750a5f0N.tmp"C:\Users\Admin\AppData\Local\Temp\is-LT3SU.tmp\418b39cd1b7e1176c41c0095f750a5f0N.tmp" /SL5="$601C6,742953,81408,C:\Users\Admin\AppData\Local\Temp\418b39cd1b7e1176c41c0095f750a5f0N.exe"2⤵
- Executes dropped EXE
PID:3560
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD554451f3b3f85cf4db1ad0d7f75af8c34
SHA150dbfe6c8ecd5fd56edc58eaa14b79d96428e447
SHA256f4875466aadd1fcf2341110614bc0bcf5d0355b30e3d73548a3b7eb85d4a2ced
SHA512d8a9385d98bf2b2bddb53925786807b0795b6ffd8db0da4b674ba5088d19aa68d2f305450fdef2dc3b13675f7307180f330af2008a15dc306e3df8e4441c9628