Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
30/12/2023, 22:42
General
-
Target
1ecb37319a63e70a5126f4dbbda751ab.exe
-
Size
2.7MB
-
MD5
1ecb37319a63e70a5126f4dbbda751ab
-
SHA1
59d17c2b1c189f2c45650a0e0c78872873ee6c6e
-
SHA256
719583b9728be8d43df77929a2896da711430941e36c50f2c2aaf6b44ea95a98
-
SHA512
d94f8e3178c2ae35d33e0b61c90f57c0d4028cf09e034760e859926709befd2357eb666b0d26112fd42001ccf908bd91c722b0362bcbfa7c9d21c4521314ba6b
-
SSDEEP
49152:FwtDcWlo8vCSp7jIfbs0oiLaiNZRnQTGj113jqaQvh5heI:WtoWlo8vCSuTLXZBQT21p5eJr
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ecb37319a63e70a5126f4dbbda751ab.exe"C:\Users\Admin\AppData\Local\Temp\1ecb37319a63e70a5126f4dbbda751ab.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1ecb37319a63e70a5126f4dbbda751ab.exeC:\Users\Admin\AppData\Local\Temp\1ecb37319a63e70a5126f4dbbda751ab.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5a8bdd3a8b800a734f6457827bf475c91
SHA13a1a6cfd0cec8f88bb8211f69f387a93f53adab0
SHA25687c575fcec182b530d8046bb31a0c012e561afc1fa37f56fb156ded9369a3516
SHA5129e8963b9e6a1481cf234292a6b0c259bcfce7ad97a1de7827f1916f5719f903e64f66b90582acb67acaeec238b2633e38f9cbcacc6d6dc5af412b0b655950609
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB