Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 21:34
General
-
Target
3db077694e62e354d060fa2aace5cf49.exe
-
Size
84KB
-
MD5
3db077694e62e354d060fa2aace5cf49
-
SHA1
ad3b22af5a47ff566b337ab7989dbd2b50334804
-
SHA256
282d1f96d583c1b04327d61425645e3a5a9352ebbce006a768079b93785d5be4
-
SHA512
2f5382080054c4947f31c13378d6346c47e35b6a522963141f3d5cf102d70b96dae4fc65cf844afd12bd6cbdfe86713a24e0867397c1d719c211eda88cf040b2
-
SSDEEP
1536:cLo0Q1Q96lZwEJk4twvlQDh3dgKGzK8nqu7OijCvBZmvmdF+GWBeN+P:cLo0Q1U6FniQDhtBpW16YIosF+JT
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3db077694e62e354d060fa2aace5cf49.exe"C:\Users\Admin\AppData\Local\Temp\3db077694e62e354d060fa2aace5cf49.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3db077694e62e354d060fa2aace5cf49.exeC:\Users\Admin\AppData\Local\Temp\3db077694e62e354d060fa2aace5cf49.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD511d2514ddc99581715a02366f7406b85
SHA126a40c421a0fdfe26de5e6bc43616d0410a11d1f
SHA256e57b94f35c1d2e5e8f3a7f2a0aeadc379f773910238107a6fb17caccd34e07ad
SHA512e2d349008e310311463ec1dad015feb437d86d81af62d94d39cccadf83ba2db2cbc2340d98aea873be169c76f463d037f6dc94c76e6cc362918e26083216486f
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB