Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 11:27
General
-
Target
038fdbfb7f46fed85b05571310c376a24ff3efb1ad80ba1625d9e4d636539f89.exe
-
Size
536KB
-
MD5
39bf0ab50c09a22792cecb6fe5c1b3d2
-
SHA1
8ddd89d0f8791f71f1904d6dac82e803059c230c
-
SHA256
038fdbfb7f46fed85b05571310c376a24ff3efb1ad80ba1625d9e4d636539f89
-
SHA512
3ebc2631e16e804eef7a0845019226cce12704e6999837d7e20801933718cd2af482bc1ce4c84c8b00f9c5770d6880ece52b023e34a5988d4ef018ffded04015
-
SSDEEP
12288:Vhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:VdQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\038fdbfb7f46fed85b05571310c376a24ff3efb1ad80ba1625d9e4d636539f89.exe"C:\Users\Admin\AppData\Local\Temp\038fdbfb7f46fed85b05571310c376a24ff3efb1ad80ba1625d9e4d636539f89.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a1f04d597102dcff7d4a7d15e7669f95
SHA10c2cb6fcc09da00eafe14ca5500b6da0b1c639a3
SHA2563fe2dd34fffba51db94882aa52161da94cd2648057ad19b68606221b59d9c42f
SHA512e0dca116d5b6d0d1c1899f34fc4187910daf9bc8b6583265861385e0d6d3237c1eb98eda2432d6993bf9f167425fea08f5a6c835d78508ca6412eb67ae82eb57
-
Filesize
938B
MD51e3efe731ff2279126ec4e8d2feb2c59
SHA14a317ed2c9005b37e50fd43502da25894003ba36
SHA256b9b4411cfa4ddd72bb752b69af2ba7eae692eb53dd88e07df937134f230c47e2
SHA5124431f09b2ced7e12167e82cef5211b1df24639ad8f70c86a0b015c441b48bf695b8544a1d99ed9d7aa7441fa7026129bff80eebd4100628fbe25636a7167fd99
-
Filesize
502B
MD548f82f97a62be95d81c9d2d611d42867
SHA17a89f8eccfffbc6350cdbb0fca203c6ff4107411
SHA25679bd4110a8d4a95b8959d90c148d9dced77be7b21d13d59c0283a8f7081f2e33
SHA5127b285a0c351e5ea34d5c44142a1b5cae5befb0450e0fbee6178208df7145a4029770fc6acdbfb2eb767cd4b7dc849a1349096dc448a283ab5db5d4ee418b785a
-
Filesize
520B
MD5a41a6d652f003af24fb319d8ab0f6bbd
SHA1088ab52310206b37c7e72e3fda05456224a73038
SHA256aa504dcb8e08e848d94af650381a51a9b614b8e7d2294a46fc42d5992d191097
SHA5128a9ea83ca23ac22fd44350f902637662ecfd9205ef224d12304453476e578a1836832003d13d41786f4b47f9b773f6c3c34417ebff30278d7d7ab3a6863e3f91
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB