Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 13:42
General
-
Target
aa75288db6ec1c283499248d40d2d77e.exe
-
Size
1.5MB
-
MD5
aa75288db6ec1c283499248d40d2d77e
-
SHA1
60825864d90612c73030fa3c771ce25cef734cd3
-
SHA256
c2f7daab60ba583ced665a371b913ce6eebb32c07bc894e01e9f41c2039a5abe
-
SHA512
cf4f1b3376588d73d78766b60b720595ecbe3656a30fbb2c473f5d1b7dc16554dd2c72a5399337cb46a71a9cb1495bb0fa0bbe6de303cdd6f548ab05e0a73254
-
SSDEEP
24576:mRXThNhKWFHT4g67qi/2WTQZaY5GoLhm4/xqBu0+9+ty/KW:AnKWFHMR7uWTQDGoL7xqBEgty/K
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa75288db6ec1c283499248d40d2d77e.exe"C:\Users\Admin\AppData\Local\Temp\aa75288db6ec1c283499248d40d2d77e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aa75288db6ec1c283499248d40d2d77e.exeC:\Users\Admin\AppData\Local\Temp\aa75288db6ec1c283499248d40d2d77e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD5547197a4bc244efad0ff72afcee0cf3d
SHA197fb09f591d6e91885f5bb97e9ed511c193a6cb7
SHA2563fa94bf2bc4d76fcb4065ac50aabea9595db72c7da2152365551471e6203fc99
SHA5121f74a26a83cece9d453f95f0afddead059b3286f79e6c1382afd4c3471d961317c0ac15990f098965659a5e07b60b4e095f4601415bf61ef756cb4d2cbbe314d
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB