Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 04:17
General
-
Target
12DNF小马.exe
-
Size
18KB
-
MD5
e076485da1aef93f3621aa6b7c05ba73
-
SHA1
3653395ed051c2524a057ddd3803a673d4ba722e
-
SHA256
7af91034be743da9149c18584ffeb71cb0db100a15739f6169a5b29755a25092
-
SHA512
fdce6b959d1fd8a1e61379b25d57f0b09c67ba274c9634a301fddefe1cc45ec1eb1b6c158afb37ee8c4e5ecbae14c5c59518dad65210807397c2118c214acc86
-
SSDEEP
384:IkJcqs0mP5C3SyeTfyEdftyVVhxY+uuyhGy1KSYz:lLhopTfyEBaHxY+uuFVz
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12DNF小马.exe"C:\Users\Admin\AppData\Local\Temp\12DNF小马.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\clear.bat" "2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
-
Filesize
76KB