Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/12/2023, 15:46

General

  • Target

    e013693afdce118675f96f00bad62d83.exe

  • Size

    133KB

  • MD5

    e013693afdce118675f96f00bad62d83

  • SHA1

    3ede49ba89e8f6baa86a7eb463156433caf4b129

  • SHA256

    b94ec3ed7a9ba11cd4e3d020f1b38e30f818dc91bde151ea81f2a0a28a2ee754

  • SHA512

    31b73e2ef36610e7e32d51f9afeae4a6ef1b3df0db62c7868efbfe17dd8f963620055920f7df106a1926b5f086fc73750610915f58305c0c95a4ba121a8a8a54

  • SSDEEP

    3072:Hn1uP6TNNOKaCaY01EKPKVYjk/+uVdh3V29M9HnJXi4wk3Ix1Q:VmmNZaf1bPKqjtkdhl2G9HFwZx1Q

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe
    "C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe
      C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe

    Filesize

    133KB

    MD5

    a7f7e40d5a83286382a61f27ca5253b2

    SHA1

    d8cb5e7ef895df685719f8c362f3c703873fa76b

    SHA256

    17303bec251c1519fb576333082d1fd5bd56cc3dc8c71493a414f5403bfc0c28

    SHA512

    697717fc689dd41d9526b1bd0a575b0fb4d0c6a4cd2d45a4af60069432967f596caac9717e2dfaa1fb5fdc676d1495574b0576e4186f192622c62ea7cc025622

  • memory/2140-14-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2140-16-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2140-15-0x00000000001A0000-0x00000000001C1000-memory.dmp

    Filesize

    132KB

  • memory/2140-33-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4064-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4064-1-0x00000000000F0000-0x0000000000111000-memory.dmp

    Filesize

    132KB

  • memory/4064-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4064-13-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB