Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 13:03
General
-
Target
9667fd5c757c319ba8aada7f39f7895b.exe
-
Size
266KB
-
MD5
9667fd5c757c319ba8aada7f39f7895b
-
SHA1
e9029324e97a44362f181f583227277a5670e59f
-
SHA256
fc4e3f4fe4d4c757874cc99aba5fdacbc624e47a79f7d7a592cba92e50e04550
-
SHA512
66efffe71c558ebb2d24537c89faf0f056b61a4801c79961a85d1e9541b67ad583fe6f714bd75f27d86e654a7e9be2e6269f46b4ecc9164f5065af4182d84f27
-
SSDEEP
6144:3kwKrIKm11SnqanM/w0v0aEIp5Sa7/tUwQv5Q:3kwt1gQWhMSa7/tUW
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9667fd5c757c319ba8aada7f39f7895b.exe"C:\Users\Admin\AppData\Local\Temp\9667fd5c757c319ba8aada7f39f7895b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9667fd5c757c319ba8aada7f39f7895b.exeC:\Users\Admin\AppData\Local\Temp\9667fd5c757c319ba8aada7f39f7895b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
266KB
MD526ff77e1a28d525321cfbecfffd13bdd
SHA19a138e8cd06a574798be7f373fbb283ab7419263
SHA25636475fcb81e7e816ff9eb63ebdae0d08e67645e142ddbcd8143f091d4a83986f
SHA51244db79ae87516f7629538d0810b76885d0bf0e9278b30fbc9f525da4c8ce0458398234429250cd067621f39f85265539658ae18117e0deb38bad7944f10a739d
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB