Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 10:01
General
-
Target
153ab098e29844e397609b81b3e9fc04.exe
-
Size
1.5MB
-
MD5
153ab098e29844e397609b81b3e9fc04
-
SHA1
ec653b383a365a6b83d79b0c0385a8ef28502a84
-
SHA256
33f20dfe483ec72a0e96863106b41198c703699e59cd328e396677d10da23e57
-
SHA512
dd802c234ed7709ba22ba53c26556aab558b6bc3f6e8217d3e98aa8994826f26ab8b8a38d215fe3e4c97a8cf4ecfcf38583e92615a1c763f7199add9b83d1592
-
SSDEEP
24576:2nwHf23OfJIqoW5rxIL+TXf/24faZT+5Z4Va5jINthlW:g6ffJlPzRP4kpcnl
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\153ab098e29844e397609b81b3e9fc04.exe"C:\Users\Admin\AppData\Local\Temp\153ab098e29844e397609b81b3e9fc04.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\153ab098e29844e397609b81b3e9fc04.exeC:\Users\Admin\AppData\Local\Temp\153ab098e29844e397609b81b3e9fc04.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5251d2204e5d8ce39c24bca92d8cef5af
SHA1506696fa0386316af74bffd40e5e82585aeffe8d
SHA256fa95690fbdc4cebc3bef4ea1a5353883d28664242d7464c22f0716a32fed842d
SHA512f039c737f6b29f71f5a5485b2384b77879dc0543a1ecc114ecfdd6120fb5f3a7ba44861eeebbd125e14c3aedefd5832f9ada904a08e501557aea90e9bfaf2890
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
1.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB