Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 19:13

General

  • Target

    20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe

  • Size

    162KB

  • MD5

    9c2e5a5513118ae4d49457462748f12a

  • SHA1

    94677c7e333db8ee4460b5c1c64526c9eaaf7aa0

  • SHA256

    20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000

  • SHA512

    6b90ba8dd696f1cd2aecd0ff429efa947f9e95071b4a5cfa0fec0aaeb7d8e04245201a76f704551bf20992b14595ee5b7992750cc5e99c47119454f2d1cc6c39

  • SSDEEP

    3072:WPBbSvucpYRrR5d+mYl/IZX0HjuRH/9xJCZcOW4I//4i:8b2E150szH/9xwcN4I34i

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe
    "C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe
      C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\20dd8046a00962e1ef739f6a0b172e8c0f41dba6a9bd26423a872a34df469000.exe

    Filesize

    162KB

    MD5

    4b13b12a7ea18867378d9e25bddce044

    SHA1

    6bc8bbbc5cd4845d89f9cb056022de02b3755cbd

    SHA256

    81c24694b8dee9dae65107aaaca099bfc31873b6418e67b027b8de15ecd10fc0

    SHA512

    a5bb0f315063f11928c06d853ab1241ca475e423eca1d482e0cb600c7515bc93cb8dabf6c037db65baa5823340ca29cb013c8d4b381ea02b59d8148dbd6fb163

  • memory/3272-0-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/3272-1-0x0000000001430000-0x000000000145E000-memory.dmp

    Filesize

    184KB

  • memory/3272-2-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/3272-11-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/4764-13-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/4764-14-0x00000000000E0000-0x000000000010E000-memory.dmp

    Filesize

    184KB

  • memory/4764-25-0x00000000014F0000-0x000000000150B000-memory.dmp

    Filesize

    108KB

  • memory/4764-20-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4764-26-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB