Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 03:42
General
-
Target
101c8b2ee5d93de3eb0f2cd388733ef7e42cb5d18039bfde623450c6ef689c96.exe
-
Size
1.5MB
-
MD5
507c5920642e0ecb41d60a8cd835d2a5
-
SHA1
c27aac57d049be8a67b88caaf2c61c615c22c012
-
SHA256
101c8b2ee5d93de3eb0f2cd388733ef7e42cb5d18039bfde623450c6ef689c96
-
SHA512
f4858b436d58ab41ff87a0d7ab10cfff00ee4823af289ee44db51e230ec9788cedf9afa1f88124d5eea9ccb146a9c322e27a34c6a474900660b71a39c21c2e2c
-
SSDEEP
49152:fElteIWkfBjbQkX3nzraEXuWUe5iLTIVY7acvAM:cAkfpQkHnzr7XuVe5iHsY7bY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\101c8b2ee5d93de3eb0f2cd388733ef7e42cb5d18039bfde623450c6ef689c96.exe"C:\Users\Admin\AppData\Local\Temp\101c8b2ee5d93de3eb0f2cd388733ef7e42cb5d18039bfde623450c6ef689c96.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\Bugreport-393712.dllC:\Users\Admin\AppData\Local\Temp\data\Bugreport-393712.dll Bugreport %E9%AA%8C%E8%AF%81%E6%B6%88%202⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
MD5f5d691ae882163ada8de6d6dda12d399
SHA103154691b92361cfc7ab29b11abaa59b6553c90b
SHA256c2f8336c7126f20d61db9632bca9070389df47a52a5da88886a72e2e6e4f86c8
SHA5129ce9f85328d5e8d7812e0b95b2ca42c3879743e7542352b922b3ef33f02e8f5fa05a35d2de623ffce559489d04f3740fba428c6369da302360779ae2b85772b0
-
Filesize
80B
MD53bab47b3b38d380a1cce241a5570a625
SHA14336d07ccd81dcbc165e63484251a2a16b16c7a2
SHA2560667398030b92a6ee37d86a2571bb8b2140635d1c5566c7347df1aed1730b7b5
SHA5123bc5fb051a553b6ae194278369ce457067cf2332fbd59a8951e7af74ee0312b5a867a61eb79e9e252fbe8484355e8b861208649a5a80a5b542d5e4ae3680daf5
-
Filesize
105B
MD5a63bbb832a45df8198ac7939c03308de
SHA1087a09337d720ee68d0e85bea4285fcc3f4f0d0e
SHA2561c43db82030e7e9c4eb69c0ec4e8c32dc63de21ed577218ea50708459d6b274c
SHA51250afcca345a0dc17b3062befe204d02ac92f0a2dda821b4a0d60dcf13f8c525aa9b47e26f51d69c6999d05ec6dd60e4c954480bec285d3cbe9e503de2ebdf605
-
Filesize
724KB
MD5a96fbd5e66b31f3d816ad80f623e9bd9
SHA14eda42260bd3eb930cd4eafd7d15c6af367bcf18
SHA2562e67ba278646fde95bb614dcbcc7da1c6bf7976c918b2c6ad3d78640000326f3
SHA51243921107313775ea14b1bd33cf758c13798f4fa1c1074771c1c96b1b43b98f3416d249ed8ab3171383772d0054829c3754a91b5e94135f1df6d67a76f599c80e
-
Filesize
228KB
-
Filesize
228KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.2MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.2MB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
456KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.2MB
-
Filesize
252KB
-
Filesize
4.2MB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
252KB
-
Filesize
4.2MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB