Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 14:09
General
-
Target
b8ea985eac7f117a0744bffb56740de6.exe
-
Size
1.3MB
-
MD5
b8ea985eac7f117a0744bffb56740de6
-
SHA1
f53f4c3e052c77a9ed7bf5d0c7bd6ce54a6b5a9e
-
SHA256
8205d3aa8812497bf8a5c43c4b5a10465b5519f9d52768f214ca3d61a9158a2c
-
SHA512
7eb13cc98bcb2aebd44c684de098fffc69e15c6fdbdcc83efd62a577b947af8c1e2c1b6d49083ac5932e60c24a9b0322fb0571e7d7659370d2540f8d0de4d074
-
SSDEEP
24576:ZdDvOMjIGk0rSS5r/6HiFvKvRbY0ShonUstDgyItRvG:jT5jIGpfNyiFv0M9+Us53k
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe"C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exeC:\Users\Admin\AppData\Local\Temp\b8ea985eac7f117a0744bffb56740de6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5f88a56121e805f010bff51c18f4f0098
SHA1bcd875749537afe1503210297b70031d05d9963d
SHA256cf5f82da28c16afeea210e929537412a2720dcd9c48eaae990af1581d1f2cb94
SHA512e0a408df3b0196b17238c76c51face150c296848d2a1d978d3a4f4391f5c6cfc5f3cf2b9ed34d1b152d813846728dc7b614ac652ad860d8231709edd0324be76
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB