Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
157s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 11:33
General
-
Target
3dca87dc4af4ecbe92e2591bdccbcca5885a8dedb321c24a4b9fdb0130a5415a.exe
-
Size
536KB
-
MD5
cee2855d2a8d92f5075a1c9efda3cd5d
-
SHA1
d80a01ae5e699541b8b188a62cd42f62abbf777a
-
SHA256
3dca87dc4af4ecbe92e2591bdccbcca5885a8dedb321c24a4b9fdb0130a5415a
-
SHA512
8d49ddf2dfa13a1c93d00afda7093127dda268bcb991cae984457286653ebeae0cc43014a0f42669ab68c8d78ff960f44952325bf21860e7008ea36cf09e7211
-
SSDEEP
12288:Bhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:BdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3dca87dc4af4ecbe92e2591bdccbcca5885a8dedb321c24a4b9fdb0130a5415a.exe"C:\Users\Admin\AppData\Local\Temp\3dca87dc4af4ecbe92e2591bdccbcca5885a8dedb321c24a4b9fdb0130a5415a.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51d41758e080d4ebcf81630b4db50cf8f
SHA18c249d4eed398fea33cade3a972e3bf4e6c0b16c
SHA25692412a85669b889a1fe94c1c43f86c796e6278f18067f0253ed06a5b91b5a7a1
SHA512ab7066f48c3f7a02e22c803473f59465df19ce031365f8e0e23587eca76512f0ec3add8f4d4eec2642761df81a517afeb3011c48405207f58d479d584d4aad3e
-
Filesize
939B
MD5c33902ba80698d5b22a508d79414cc2a
SHA1fafe4e242e857d45741c36c1925de8e171ada2b0
SHA25667c27a6ff6da949746a432f2feef1e8f699d89b88ce9d2240673614be2201fba
SHA5121af1a62d9f77a05693e9ed46b54509c567a08bef8817cd0939f603db816964324c168f109b0b8b4b31032132cae6be4e4add7fa3bc46668accd0a7cff52cb114
-
Filesize
502B
MD58c989e33fd158db37bc558a036f6d6eb
SHA1645f377f02b24ef618ca1db674f89859688aee75
SHA256b768dc0cc78b7e0cf66db6ad062c53f7edd9ae4445b5f073d6a84eeb08d34358
SHA512838a5dac6f6c5334af931899381112d303a12a0b25089febde679855972958f4e06f20110cde25450546092e34e0a164ea7b9326f09b3267d2176e3ea5101106
-
Filesize
520B
MD54b37350c9cc37634013e731eae15f006
SHA15fd8c56d7787fedd55edb72965e8e836a0137ffc
SHA2566512a6c968bf2bfcf8500513aca6d6289b7abe2e0b465d4ff46695a7f83aff6d
SHA5126a7b200ab2e4629795a5ffce7dfb95b6ef3fc64c0315727c8ed7e8f0962e23318f4e87671d5aa69bf3e3bad6c06d12eb58d2b943a99aceae5a8ef229045c303f
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB