Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 11:39

General

  • Target

    892d6ab541c43312b2e7a7a4b4f3d09c.exe

  • Size

    5.1MB

  • MD5

    892d6ab541c43312b2e7a7a4b4f3d09c

  • SHA1

    23f31d8f44b323a0e237ed48060747ce205f413b

  • SHA256

    dcca5eaab252137d9e4b1d0bacd270c9af11277d920b39ca5d615ef67f0fa040

  • SHA512

    c8c83ece6dbffd32f1fb815bba79673c66f2f188a9060f477d4567e75d608ef8810b363da5ff8c2a81c8049595e5d37fb20b1231be963870f509159955a3c4c7

  • SSDEEP

    49152:BWg1RAF0caVzDYHDQm6PrBX/erQ94/uDesxBMFz4ULiay368BRmodNm/ItWCbESd:TQHIuQdD3Fmd/sdXi1Znjdx9u33

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\892d6ab541c43312b2e7a7a4b4f3d09c.exe
    "C:\Users\Admin\AppData\Local\Temp\892d6ab541c43312b2e7a7a4b4f3d09c.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Users\Admin\AppData\Local\Temp\892d6ab541c43312b2e7a7a4b4f3d09c.exe
      C:\Users\Admin\AppData\Local\Temp\892d6ab541c43312b2e7a7a4b4f3d09c.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:1000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\892d6ab541c43312b2e7a7a4b4f3d09c.exe

    Filesize

    132KB

    MD5

    4f766cdfeca2f8f12b3b86ecc6afd3b2

    SHA1

    f0cd34507f65f205882c7f168b00467290c79313

    SHA256

    5db75fed5f26bc58875fd0089d61fc03c73c16f6ecdb8cd678fb5a616baffe27

    SHA512

    39f0d5768fa083681b8a17af117953a8349cbc259f763870a7dfb3cb4855737cced344ca853008aedbf21c727ceaa38236c59985841b203d0068b7263b3b840d

  • memory/808-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/808-1-0x0000000002200000-0x000000000245A000-memory.dmp

    Filesize

    2.4MB

  • memory/808-2-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/808-13-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/1000-14-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/1000-16-0x0000000002440000-0x000000000269A000-memory.dmp

    Filesize

    2.4MB

  • memory/1000-33-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB