Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
195s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 02:47
General
-
Target
0c1fd5325e6b965ee2e31543ed766a6d.exe
-
Size
82KB
-
MD5
0c1fd5325e6b965ee2e31543ed766a6d
-
SHA1
d928dce10ef8c29749e340ad832d9ae2125a8029
-
SHA256
732571bea86b6fb68504c0ca881928deab7f0a9d8ef18f4b50fc8c3c2b62df23
-
SHA512
95a369da9e595747fb190798710310ff110e2eb2759e8404635dc0bd66cdbe8073012930586b48f79edc35a86ebcd49033fe9c405b53ae96405b706a6f82757e
-
SSDEEP
1536:rAEH0r1JZtNG1GhSfYSpo4dGyjpmoFCFBKHQkq7JAMBNDb+q4:xH0r1J3g8SfYSpBGykoFCFBSDUJAyNfo
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exe"C:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exeC:\Users\Admin\AppData\Local\Temp\0c1fd5325e6b965ee2e31543ed766a6d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD576a17358a93bad053f5ded17b453bab1
SHA192470d347665847f22d9f4e687e12f5d010968a0
SHA256f3912ae22ebca4c1ee2cd35933d0ca509db6449a96656e5d5556bc4c6765e62f
SHA512374a8ba19135afcdfcbd280bbd606c75ff9eb652903b9b91d3146a5229ac05ea31c7f7c45dfaa210e2edd0e1e17f8e714c20699b5f52ea578e7bf1b4da6c7c18
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB