Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
114s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
10/10/2022, 23:55
General
-
Target
87179eddf35f43b2f6f7c7e1411e8afba758160da9ed340838100f2b442558ff.exe
-
Size
256KB
-
MD5
7c35351f4c0d9a015e72fc237f672570
-
SHA1
df7333669001df6d4aa9a1da275f4e5c0f499532
-
SHA256
87179eddf35f43b2f6f7c7e1411e8afba758160da9ed340838100f2b442558ff
-
SHA512
218e2a495223802267b7273f53ea21f0d12cbf769e773f2f8826cd099ec00421f8e36d1df918482c7f62fb8edc936c13b147184d7099c1a3e2505c8021d4547a
-
SSDEEP
6144:LjheaN1bO8m9pEUFhuoY8laLSWmH60HwYg6XDNx:VfChkl/lj6Bx
Malware Config
Signatures
-
ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87179eddf35f43b2f6f7c7e1411e8afba758160da9ed340838100f2b442558ff.exe"C:\Users\Admin\AppData\Local\Temp\87179eddf35f43b2f6f7c7e1411e8afba758160da9ed340838100f2b442558ff.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\207411a8.exeC:\207411a8.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226KB
MD5cf1466e3a3ebfaabd919fe01f4be17db
SHA190d57e3e173222394914189d24ad9408744d6dc7
SHA256cb8cfeb89ff3870cc2b3599f1697999b7c005a3b17fd117b4de3aa86569fb222
SHA5120b1e9ed13a8bc78fad400f5edf25c9b622c1841ffc4307dc38950acb9812f2eedd08b5ec61be1aa44a8ef7f8656671443411e44cf270e078bb3de0c249da4432
-
Filesize
226KB
MD5cf1466e3a3ebfaabd919fe01f4be17db
SHA190d57e3e173222394914189d24ad9408744d6dc7
SHA256cb8cfeb89ff3870cc2b3599f1697999b7c005a3b17fd117b4de3aa86569fb222
SHA5120b1e9ed13a8bc78fad400f5edf25c9b622c1841ffc4307dc38950acb9812f2eedd08b5ec61be1aa44a8ef7f8656671443411e44cf270e078bb3de0c249da4432
-
Filesize
724B
MD5636c3fee174310b58ea5f73a771904d8
SHA112f3d096081494adafe5092032c2fd6ef599810e
SHA2566f497ee321673c14ee2335345c968a51279841a5fbe1701bf51715f5e178fb17
SHA51253eb58a9102aaaabca4fec5fe0c3bb08ec702c1b57e8fb3b4d97e693089c07a7f11ede2293d03293ee13329216470dfb57b9b7b791e36aded338c8410e9201d2
-
Filesize
226KB
MD5749f0a7119505ff40d98aef078d44d7f
SHA1a56ed810a73ff7a0f4004224cc3fb7ca534cf20f
SHA256fa51619f5efe4ddd281451a9ec27b4abb52aef70d1f8f65d169f0eba98c8c768
SHA51248dfb6057f4235ec5a750065b779e6396f8cca19f3927c8ec7866951ba080b6b2aa688acb3bfa62cd721ab27e801f2c97488e9881557f59db4e94be3db424be4
-
Filesize
226KB
MD5749f0a7119505ff40d98aef078d44d7f
SHA1a56ed810a73ff7a0f4004224cc3fb7ca534cf20f
SHA256fa51619f5efe4ddd281451a9ec27b4abb52aef70d1f8f65d169f0eba98c8c768
SHA51248dfb6057f4235ec5a750065b779e6396f8cca19f3927c8ec7866951ba080b6b2aa688acb3bfa62cd721ab27e801f2c97488e9881557f59db4e94be3db424be4
-
Filesize
255KB
-
Filesize
255KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
64.0MB
-
Filesize
288KB