Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24/12/2023, 21:57
General
-
Target
141e05ca1c94e8f0966e2e4ee048e7a5.exe
-
Size
59KB
-
MD5
141e05ca1c94e8f0966e2e4ee048e7a5
-
SHA1
9efd6c784f5467d503525027b1b1f164fbe52391
-
SHA256
dee0f4655bbab6bbb82b64fca5c3d650f6efff046ece71c285dd2d4f8bb1194a
-
SHA512
b9a001dbbbd56bdeed4b74647d1b6525ffcad0376413f9db853838cf88ee0793ef5771317e13f0eaa83172dd1e9c7ec31a13a4601143552e54e5a8e573c2df2a
-
SSDEEP
1536:GzU/xDnz8dYnbPK8nqJyZrTMPTWVDSuu5hU/Z:phI0PKr7TWVGTUZ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\141e05ca1c94e8f0966e2e4ee048e7a5.exe"C:\Users\Admin\AppData\Local\Temp\141e05ca1c94e8f0966e2e4ee048e7a5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\141e05ca1c94e8f0966e2e4ee048e7a5.exeC:\Users\Admin\AppData\Local\Temp\141e05ca1c94e8f0966e2e4ee048e7a5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD56227937f3c3da511e16084464911b983
SHA1bd0be3f647ef7780e3192b6d0feac6eb07e9f1d9
SHA25677b9e315c191f30182e958681237c487d9c53963eb194f7cb65e649c37b6441a
SHA512fabebcd8028d4ef17203eb04902df870870a8ef9255ef50c324f63b561847e62d19ef8b07716d35c87e920d45dd3ca99bc0e70c21cf7b78399eb8f4a72ba2de0
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
60KB
-
Filesize
116KB
-
Filesize
116KB