Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 07:32
General
-
Target
12385b6c626b12cbef8699ec9b738dbd.exe
-
Size
82KB
-
MD5
12385b6c626b12cbef8699ec9b738dbd
-
SHA1
80836a51c90c0df8a1580f033f854a45f34816fc
-
SHA256
6a2ca68e719efcfad66d1654f5a0a887784c2b19b4d55e4819d3735f1078fb28
-
SHA512
62bcf614cbcbe41150124e13ea5c718d276474aff3731e51c36fb5b8bf9597aa079e5fce5b9c39c8e841df2065c175ea82b18d97601bcf8ed5094f6402f954d5
-
SSDEEP
1536:wNAXczlJUajHMc4IiZ0wBSaNlVNCKw4EiCXEbzxoOK8Ays1I8Od:bMB+5c490ALVNCKPbiGK8Ays17+
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12385b6c626b12cbef8699ec9b738dbd.exe"C:\Users\Admin\AppData\Local\Temp\12385b6c626b12cbef8699ec9b738dbd.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\12385b6c626b12cbef8699ec9b738dbd.exeC:\Users\Admin\AppData\Local\Temp\12385b6c626b12cbef8699ec9b738dbd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD567fcd461d7eaaf7d48fce79b6a28ec1d
SHA1a14af9e9c5545b2a41e4f7a2884c7405bd5ca683
SHA256b55f0e45891d841e58ab31aabc3517911d3cc2e39705780d1441844462303c23
SHA512ad0cff921dc11e97091ad0431b4b8b3edbb274163de6c684f60ea8e29899ed8991b761e8e552f27564e28b4b00421c8ea8eb281b20676565b51c5e198bf28518
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB