Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
c2c02cc7dcb43c89b463ec0b2f374130N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c2c02cc7dcb43c89b463ec0b2f374130N.exe
Resource
win10v2004-20240709-en
General
-
Target
c2c02cc7dcb43c89b463ec0b2f374130N.exe
-
Size
84KB
-
MD5
c2c02cc7dcb43c89b463ec0b2f374130
-
SHA1
a463373b3d4b2cbb6812bb8a988f43fe1804c894
-
SHA256
188ed30e6ff2a8f9cc38f304ec14e14fb360aeefbe64bd6ace382c31c899a533
-
SHA512
1d5393d7b9c8f04ecfb87089395c4e0bfc26ba6d28a72dfcc216ed60e20cbe279bb77c506417dff0d79c8844fc6557464f8648659728a2cb07fa960ff81127bb
-
SSDEEP
1536:4j0h/qcO2BXCYwrWgH6jRwyw8xog/BK6ENcFho8Casx1IReCuNsPF+Pk0/WgENgF:LpqkXCFH6twywj9/8fsqRebNCQc0/Wg9
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2272 c2c02cc7dcb43c89b463ec0b2f374130N.exe -
Executes dropped EXE 1 IoCs
pid Process 2272 c2c02cc7dcb43c89b463ec0b2f374130N.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4868 c2c02cc7dcb43c89b463ec0b2f374130N.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4868 c2c02cc7dcb43c89b463ec0b2f374130N.exe 2272 c2c02cc7dcb43c89b463ec0b2f374130N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4868 wrote to memory of 2272 4868 c2c02cc7dcb43c89b463ec0b2f374130N.exe 85 PID 4868 wrote to memory of 2272 4868 c2c02cc7dcb43c89b463ec0b2f374130N.exe 85 PID 4868 wrote to memory of 2272 4868 c2c02cc7dcb43c89b463ec0b2f374130N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c02cc7dcb43c89b463ec0b2f374130N.exe"C:\Users\Admin\AppData\Local\Temp\c2c02cc7dcb43c89b463ec0b2f374130N.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\c2c02cc7dcb43c89b463ec0b2f374130N.exeC:\Users\Admin\AppData\Local\Temp\c2c02cc7dcb43c89b463ec0b2f374130N.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2272
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD5efa7c3bee43bdd91898988663a93327c
SHA176d256c6d5337c7b084806288a2e8a055f468e90
SHA256b1d587b113bd8cf739d7605a1ea47ee1d5184b858e168a853faab3c48731e584
SHA51271091033dbdc73a609285f11b09f7d96b72acf1040f38ca4138f5a9ed28d8b681f939606a70d8d7412b2e79e45220d54a50ee684219e518df4d0a6f52a35008d