Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
30/12/2023, 03:50
General
-
Target
0d79e7323786394f0d89b4d7590e96fa.exe
-
Size
82KB
-
MD5
0d79e7323786394f0d89b4d7590e96fa
-
SHA1
b642482b0980ec5e2031df05b9119fa76be9f230
-
SHA256
baca6a8dda4cbb1da93b5c2b418bd6a45b63b7ad8a5cc919e46bae6823a646e1
-
SHA512
cbcd523cf2d2dd768d28e9a37b6ae5f169a2f8fd58406b7557ffdca54446a5f758fd2817e02eca0ababf6624e3fdaf16519995fdf790cb71e62a2f3d32237c09
-
SSDEEP
1536:CIw4srbbYvfW+CDMEXEAGKhpEbnmNHPNlTvc4Mj9MPhYVzRHENy/PYKp44TG5V:nFsrY3W+nE0AGKYbEHbwD+mzRusgKp4z
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d79e7323786394f0d89b4d7590e96fa.exe"C:\Users\Admin\AppData\Local\Temp\0d79e7323786394f0d89b4d7590e96fa.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0d79e7323786394f0d89b4d7590e96fa.exeC:\Users\Admin\AppData\Local\Temp\0d79e7323786394f0d89b4d7590e96fa.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5e2c1c6982b289a7ee90857527e7f86d9
SHA13cb6aff571d03a1fb286de769665350055db9e3f
SHA256dc5bb9d4ce3259a3e547e8257f8486f94745e78ece8b8f4e1dfc16605ea50ad2
SHA512ed9f178269ae52476fb3e611c9aa4fc3ddb62ea13813c6386349c06476840aa644422b3f0239089b92f7c270fe50f07c7166fd2a5ebd7ba222f0f65140c77379
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB