Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29/12/2023, 19:01
General
-
Target
01211ef251f99ad9442607bc6dde96fb.exe
-
Size
2.7MB
-
MD5
01211ef251f99ad9442607bc6dde96fb
-
SHA1
86f3deccb1643b20c41a5b05d5fb04a78f514060
-
SHA256
40291ef74bbef634f4f55426f0c9e086cafacc815b7c41a0f4143875511c20b2
-
SHA512
80eed8bf978208f67228c5d7472178104fc1ab2163ffe5ad6969b139c6eefa9ef7a4e9ceb55a55806c03089804a248e3fdb8849e4937ecd666fcee927683c76e
-
SSDEEP
49152:Ktpa2FDhbqy3Fihl6iYFFUi6y2YAQN74NH5HUyNRcUsCVOzetdZk:uI2FDh+y3FihIxFmC2YX4HBUCczzMO
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01211ef251f99ad9442607bc6dde96fb.exe"C:\Users\Admin\AppData\Local\Temp\01211ef251f99ad9442607bc6dde96fb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01211ef251f99ad9442607bc6dde96fb.exeC:\Users\Admin\AppData\Local\Temp\01211ef251f99ad9442607bc6dde96fb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB