Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2023, 11:51

General

  • Target

    14dc08a8ca5c266b4cf3c4a58d6c4e5709c17d1f8a23d98a580647bb3a7c5a57.exe

  • Size

    960KB

  • MD5

    24115324ab8d39ff5bfbcef52aa0eb34

  • SHA1

    ed06c3f6871fa8c4c1b1b3ae2636d5d8a598feba

  • SHA256

    14dc08a8ca5c266b4cf3c4a58d6c4e5709c17d1f8a23d98a580647bb3a7c5a57

  • SHA512

    db44f5e2b6d7b139de3a80200f92f97db71f081d555d84d7dd90f4ba389ee99cf9176df8ed52489cf5124b2152193acaca6519039f20696169118a8688bd9fc7

  • SSDEEP

    24576:ohDUjDZdzKr52akl9CCdVpP17PTDsLleH:ohD2DzKr5slpVpPpbwlk

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14dc08a8ca5c266b4cf3c4a58d6c4e5709c17d1f8a23d98a580647bb3a7c5a57.exe
    "C:\Users\Admin\AppData\Local\Temp\14dc08a8ca5c266b4cf3c4a58d6c4e5709c17d1f8a23d98a580647bb3a7c5a57.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4416
    • C:\Windows\SysWOW64\tasklist.exe
      /FI "IMAGENAME eq explorer.exe " /FO CSV /NH
      2⤵
      • Enumerates processes with tasklist
      • Suspicious use of AdjustPrivilegeToken
      PID:1544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4416-0-0x0000000000180000-0x00000000003DD000-memory.dmp

    Filesize

    2.4MB

  • memory/4416-3-0x0000000000180000-0x00000000003DD000-memory.dmp

    Filesize

    2.4MB

  • memory/4416-6-0x0000000000180000-0x00000000003DD000-memory.dmp

    Filesize

    2.4MB

  • memory/4416-8-0x0000000000180000-0x00000000003DD000-memory.dmp

    Filesize

    2.4MB

  • memory/4416-12-0x0000000000180000-0x00000000003DD000-memory.dmp

    Filesize

    2.4MB