Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

0e059d8f4b...0f.exe

windows7-x64

7

0e059d8f4b...0f.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 04:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0e059d8f4b289782462a62a2934dd40f.exe

  • Size

    1.3MB

  • MD5

    0e059d8f4b289782462a62a2934dd40f

  • SHA1

    6acb92e1859af59c8ae51d591babed9959339009

  • SHA256

    f620023ce9f5c1e11025c082605b74d2002097b7066b74078c197bed3f2aa844

  • SHA512

    03311c5e56cddc4e75429a9560a4e433e06019b7056c3601bf2b56c9ac8029766b12fd0afbf6309940fc92bc4a2b0b68d867bfcdbd82f02a01ba954d9741396d

  • SSDEEP

    24576:WTTp81+wq0ovizGhDw+Pi0GRMbEyNnZOFUi4kid6iYU9/9Us:WTTp81+wq0Dd0GRMbE02P4ldtHR9j

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e059d8f4b289782462a62a2934dd40f.exe
    "C:\Users\Admin\AppData\Local\Temp\0e059d8f4b289782462a62a2934dd40f.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\Users\Admin\AppData\Local\Temp\0e059d8f4b289782462a62a2934dd40f.exe
      C:\Users\Admin\AppData\Local\Temp\0e059d8f4b289782462a62a2934dd40f.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0e059d8f4b289782462a62a2934dd40f.exe
    Filesize

    1.3MB

    MD5

    57e1df5232e6ea59c30027adb9f98e5b

    SHA1

    5102318ca0831bf45327f279014f9e8f5f4301e5

    SHA256

    e878449fcc191079bb1844d3b11bed366b91ee17768b8fb50300d67aa48f0b4b

    SHA512

    28de469f9c2835d98e75e9328687586a5d6b48278375b8963b23bed80ad0b3e4224eff04d6f774b373a63ec396251ffa3c1d4504b8e7b984c6cc2332dd44b6c8

    Download Submit

  • memory/3632-0-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/3632-1-0x0000000001D20000-0x0000000001E51000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3632-2-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3632-12-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3760-14-0x0000000000400000-0x0000000000622000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3760-13-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

    Download

  • memory/3760-21-0x0000000000400000-0x0000000000616000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3760-20-0x0000000005590000-0x00000000057B2000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/3760-16-0x00000000018F0000-0x0000000001A21000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/3760-28-0x0000000000400000-0x00000000008E7000-memory.dmp

    Filesize

    4.9MB

    Download