Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 02:47
General
-
Target
0c1fd5325e6b965ee2e31543ed766a6d.exe
-
Size
82KB
-
MD5
0c1fd5325e6b965ee2e31543ed766a6d
-
SHA1
d928dce10ef8c29749e340ad832d9ae2125a8029
-
SHA256
732571bea86b6fb68504c0ca881928deab7f0a9d8ef18f4b50fc8c3c2b62df23
-
SHA512
95a369da9e595747fb190798710310ff110e2eb2759e8404635dc0bd66cdbe8073012930586b48f79edc35a86ebcd49033fe9c405b53ae96405b706a6f82757e
-
SSDEEP
1536:rAEH0r1JZtNG1GhSfYSpo4dGyjpmoFCFBKHQkq7JAMBNDb+q4:xH0r1J3g8SfYSpBGykoFCFBSDUJAyNfo
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exe"C:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exeC:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD593b87895db053efabd18c18771bdcd17
SHA156b27c503d2e9261443f8696bb01420b0432b8df
SHA2560a5693205f585f025fbed13191f04719e24c249868d2d36d43d3e1312b3c99c0
SHA512af5dcc50ffff7c2d63f606d7e6c60259397abadef5ec3a1cbc6a5877da618e02b392759586f24f5206c7c4b62e22bbe1a67c6931d6366823a71ac4c72f6bf558
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB