Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 18:09
General
-
Target
00169ea6e3ce70bddfda6c5befda3084.exe
-
Size
1.5MB
-
MD5
00169ea6e3ce70bddfda6c5befda3084
-
SHA1
4929f2714815c86f4e8d55fe40129501ae167eaa
-
SHA256
ad2b4ffeb87fa58af474e931cfc4271b473a36ec46945e61263e983fa21c502a
-
SHA512
7817328af2164029d6d53350f805cbf32f45a5feb989f7025123017160ba2f38253eb25eae689c7c643fbb7760341ce6098611775f7ed20f2a913ce8a7cba9fc
-
SSDEEP
24576:6tnn98igOKptGDwPffv3Xp+vlrUCr2Rze0HSnlhgsvR98RW:6NXgOKpwGffvJ+RU6WeASnlz9k
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084.exe"C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084.exeC:\Users\Admin\AppData\Local\Temp\00169ea6e3ce70bddfda6c5befda3084.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5f01f92f466dbc83120165b116af4bbce
SHA18e624baf654efc865d1ef5c68f2f7232f64f3701
SHA2569ff201cb6bed5bd598090af6b01a5697194ca4d9065edc9f782916f7ea15614f
SHA512344ade2cd590ff89134b12aed95c9ed609ca9a81a3f4bbf9b0ff46d349060106e7a8fcc529d5c02f7d929fc88e762fe209f8af64f25f8a9543350d6831370c13
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB