Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

c2d5c99710...92.exe

windows7-x64

7

c2d5c99710...92.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    154s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 14:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c2d5c9971018d08859bcd18f1823b192.exe

  • Size

    2.7MB

  • MD5

    c2d5c9971018d08859bcd18f1823b192

  • SHA1

    f4b6f7c1347aad97bba2015282a07975bec069e3

  • SHA256

    d0f3444b484f3e23d0697ed2182b82894b64e02d2d025fb95cc64e2fb810dab6

  • SHA512

    4856920344ae81b1c0197814dad812665441af6947e2726756da87b66af4aca51d952b9560189e6e4aca07545071f25bc70b6c24a2a1f75ed4086669a0a4f887

  • SSDEEP

    49152:wjO+L2KU1x8vqwR1/ZHgAIGt98c0pVxwcsXLCR9SCL2EeLPxTCkfUM65IhNH6nsk:wiOU/MH998BvwVLCHSCL2EeTFffNHHsD

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c2d5c9971018d08859bcd18f1823b192.exe
    "C:\Users\Admin\AppData\Local\Temp\c2d5c9971018d08859bcd18f1823b192.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Local\Temp\c2d5c9971018d08859bcd18f1823b192.exe
      C:\Users\Admin\AppData\Local\Temp\c2d5c9971018d08859bcd18f1823b192.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:4028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\c2d5c9971018d08859bcd18f1823b192.exe
    Filesize

    78KB

    MD5

    d08decc5f2d6cfd9fe0f23bf2b5fc63b

    SHA1

    4d849d88a3495fad7b5e16077028dddd699d2517

    SHA256

    5865613db813bdae27246c271d31aaf359d4695ff7f88dbe9eb6dacda1376692

    SHA512

    d667bcf71ddaeaa7060e5ca476b50190071d2b05d4eafa35b565a955a9ae258f39bdab83aa26b22fd65735641587d76d984bb4faa686a9e2f9afdbcd57dca9a0

    Download Submit

  • memory/4028-13-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/4028-15-0x0000000001D00000-0x0000000001E31000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4028-14-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4028-21-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4028-20-0x00000000055F0000-0x0000000005812000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4028-28-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/4496-0-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/4496-1-0x0000000001D80000-0x0000000001EB1000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/4496-2-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4496-12-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

    Download