Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 15:48
General
-
Target
e13ae2d7e6c1245b2ec3638aa9db3f24.exe
-
Size
1.3MB
-
MD5
e13ae2d7e6c1245b2ec3638aa9db3f24
-
SHA1
287b5df5d7c20beb275ce4f23589a1f622b007de
-
SHA256
af12a7b9416073faaa640c5472788c35dd6371cf8243bb7dfa9fbe3d5af0d5b6
-
SHA512
a74d177c98b2977c348fd5de0ffa3837d31f77237fbb97a66bfbd871ec4a7fcea69a00299bdb0e26bfaab492145f5a2ad2d33a3a03a7b4fc3930dda23abdb5a0
-
SSDEEP
24576:ZK82l/N73rqso5jkN+21PtGLAMuSIGb0sEYoSSHDYRnbdoWc:OlF73GbAIMRM3IMNEYoS9dop
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e13ae2d7e6c1245b2ec3638aa9db3f24.exe"C:\Users\Admin\AppData\Local\Temp\e13ae2d7e6c1245b2ec3638aa9db3f24.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e13ae2d7e6c1245b2ec3638aa9db3f24.exeC:\Users\Admin\AppData\Local\Temp\e13ae2d7e6c1245b2ec3638aa9db3f24.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5676649db8abd61d5078a898b6fd46ebc
SHA1406759931919ee92fcf61210590019b77253cab1
SHA256a9d66292a287e7825f3b9a50c993f8ad2cbace61aac4c3232c66889b2ebd6f31
SHA51294709529e00e8daec2111eba00514d6b51c8d9c8a34866b6d6361fe4857b90b0d9a6496d0632c30e33045e40eedefb5fc929943e3d25e27b7d4d6dad6c9f7f05
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB