Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 16:19
Behavioral task
behavioral1
Sample
otp.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
otp.exe
Resource
win10v2004-20240802-en
General
-
Target
otp.exe
-
Size
5.3MB
-
MD5
c67810e7b3665bdb07065a6e9cfebc79
-
SHA1
9896d44a9f00b0938f605a2f868d1863ac1b56a7
-
SHA256
c20ca1fdbfa65887838ce07951d71f50009613bc0f1060346659c33909e132d4
-
SHA512
a3364f5c21e0a664c97161ba275890d748f08db362157549f70273d093e4cb9f18a30bbd1af000981bb55f8cde8ba3bafd8abb5c8940f4320e706758d97a5cbc
-
SSDEEP
98304:2S883epzb71QGQCPDbZfx8ayCb7BJ5mjwNwwMeZYobSr+zO5cFEJ:2StsdQmRJ8aycBIGpEou5cS
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 5032 otp.exe 5032 otp.exe 5032 otp.exe 5032 otp.exe 5032 otp.exe 5032 otp.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1088 wrote to memory of 5032 1088 otp.exe 83 PID 1088 wrote to memory of 5032 1088 otp.exe 83 PID 5032 wrote to memory of 3448 5032 otp.exe 84 PID 5032 wrote to memory of 3448 5032 otp.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\otp.exe"C:\Users\Admin\AppData\Local\Temp\otp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\otp.exe"C:\Users\Admin\AppData\Local\Temp\otp.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 0A3⤵PID:3448
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
119KB
MD5ca4cef051737b0e4e56b7d597238df94
SHA1583df3f7ecade0252fdff608eb969439956f5c4a
SHA256e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
SHA51217103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3
-
Filesize
75KB
MD50f5e64e33f4d328ef11357635707d154
SHA18b6dcb4b9952b362f739a3f16ae96c44bea94a0e
SHA2568af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
SHA5124be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643
-
Filesize
812KB
MD5524a85217dc9edc8c9efc73159ca955d
SHA1a4238cbde50443262d00a843ffe814435fb0f4e2
SHA256808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621
SHA512f5a929b35a63f073bdc7600155ba2f0f262e6f60cf67efb38fa44e8b3be085cf1d5741d66d25a1ecaaf3f94abfe9bbe97d135f8a47c11f2b811d2aac6876f46c
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
4.3MB
MD5deaf0c0cc3369363b800d2e8e756a402
SHA13085778735dd8badad4e39df688139f4eed5f954
SHA256156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
SHA5125cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989
-
Filesize
28KB
MD5c119811a40667dca93dfe6faa418f47a
SHA1113e792b7dcec4366fc273e80b1fc404c309074c
SHA2568f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
SHA512107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3