Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 17:03
General
-
Target
fac9ebca0b28e2836fad67b1cc3d1baf.exe
-
Size
4.4MB
-
MD5
fac9ebca0b28e2836fad67b1cc3d1baf
-
SHA1
2c109ab045b131e94c1438f0fa2c54ac7a2dad9a
-
SHA256
ff66ab421e3865de1b88487bfdc28fe0be229371eb19b3c7100541878e2dabbc
-
SHA512
18a2e5d7632f8ed65247cebed4ceea3dd68b07daa040dc6aa5231bc6bd36c00ebe6a3ff7b413c79ba08cde64915dcdfc096f6b732086db40d050e3206904cf47
-
SSDEEP
98304:FN59LA3/4HBUCcqFp1HK3UT4NT4HBUCcg:FNPkAWC/f1q3ULWCX
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe"C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exeC:\Users\Admin\AppData\Local\Temp\fac9ebca0b28e2836fad67b1cc3d1baf.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
362KB
MD50e6c346f8ef68c5f9a4ba00eabe057cc
SHA1e67725e3a9c15d7290455b0cbc16fff5371b26dd
SHA2562d6f7a0c2c22f0317f844f6eb1f830da2ba165620d7e3dc3e65a8cd23f241e04
SHA512fa6e8aa7a7129ca741b5ea42a055c50cdd2b8870fb0a0c362b45b716dabb361b06ae5775ccae9df2b19bdca29c157a1d8faf61388421fa17fca97786809317a8
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB