Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/12/2023, 07:42
General
-
Target
0fa3ece3df887c2e7521c3569fb259fe.exe
-
Size
115KB
-
MD5
0fa3ece3df887c2e7521c3569fb259fe
-
SHA1
83f8349df71209107fb00003e599d391f6eba600
-
SHA256
dd0953c2267700112fae78863569a4366d20ca224318b55c01671d3f61a85cbc
-
SHA512
c24cbc6f5b073a400519d193de48035d50f8d1f94ba27fa593ccc9f2dd5dc2c25764dc77578f84ec275ee70a57501cec13cce6c6989b4347e846ba047c6887c2
-
SSDEEP
3072:DGgTPMbRq/xn0XOD2AbG4s5i35gBQr9kxQHj+wOX+9f:DdTaNAbGx5QgyrSxQDQu9f
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe"C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exeC:\Users\Admin\AppData\Local\Temp\0fa3ece3df887c2e7521c3569fb259fe.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD54f1d4f3c6c5c4604791d3d3c155348d5
SHA19e6c7b9bc355c03450ab4896c1aede5e3085afa0
SHA256a2817c3b1acd640143d65e058b724e2bcffe1c628a33db38640286572d12f298
SHA5122134c79f8fe9c536593f749253a334caf2f7834c090c7136c98ec96708bb5e135edeb8f0f5b4d15dfdc7dbb21b528b44c2eb5d7bede1fb7529d6dc427e81022b
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
468KB
-
Filesize
116KB
-
Filesize
56KB
-
Filesize
116KB
-
Filesize
468KB