Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 13:25
General
-
Target
a20178f963069aa52050dcfe24bb95d7.exe
-
Size
10.6MB
-
MD5
a20178f963069aa52050dcfe24bb95d7
-
SHA1
b151631e7109044faf4d566a2d7aaf7feeec4ba1
-
SHA256
39be35a600befb79eaeabbe889acd36fd6335c8a4be98acee7b4de996235c354
-
SHA512
58327dd1f9fc908584e9d4be5aa7880aa24234f494c9e987ee4727d72991d79d9ddbdd17b43bc1d504225443137e7eabd30fa9106910b78bcaf1ce691cfbf849
-
SSDEEP
196608:OrZGsO1cHo2gdw1xHo2gd1J0MAckNHo2gdw1xHo2gdD:OrpW2bc2M0Wkm2bc2M
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a20178f963069aa52050dcfe24bb95d7.exe"C:\Users\Admin\AppData\Local\Temp\a20178f963069aa52050dcfe24bb95d7.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a20178f963069aa52050dcfe24bb95d7.exeC:\Users\Admin\AppData\Local\Temp\a20178f963069aa52050dcfe24bb95d7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201KB
MD52720f96d34aa4a1677991943aa73d53c
SHA1ba50c89bc97a6d221349368265f5b0af75778168
SHA256424b90e4e7c401138a17682488363b9b0bfdf6dfd6b77d65e7dd965dbe5c28f5
SHA5126a076426e314f75caffb9ecda0b9d12fe0676b58ef324bc1f10562efb22b23ca2ed25117922886ff1fab56b2eca1242db636e623d503171fd8df00755cf41fa2
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB