Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 12:06
General
-
Target
cd362194b28b1129438f775345081e48437371d97133a4050ffc86338abdf87c.exe
-
Size
536KB
-
MD5
8d8480a26de222eaad29882ed688f472
-
SHA1
e385ebed402c5fdc8a797354a2f5c51f9487c1a8
-
SHA256
cd362194b28b1129438f775345081e48437371d97133a4050ffc86338abdf87c
-
SHA512
1ef275cc2f9e2e651e1792b57c332c86c6bbef3cc33f7ea8f4d2d55eeafd49c4fbf1a29b7db20ad434bc5ef3174d517dbd8611841c210a82951a805d13551adf
-
SSDEEP
12288:Hhf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:HdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\cd362194b28b1129438f775345081e48437371d97133a4050ffc86338abdf87c.exe"C:\Users\Admin\AppData\Local\Temp\cd362194b28b1129438f775345081e48437371d97133a4050ffc86338abdf87c.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5fea30b5dc23230b33de9328e0234fd28
SHA1b2e00f3b1f16a6f6a20697959f91836ec8abc3da
SHA256646f6414abe0518c898831bd02b332cd22e1b6386c89733e36e68c4adecf7876
SHA512e059cd42f0ecf14519b225dd343404c82e96c3c2d84765d779021240c258fbcc186968bbb1995efb12a8687c6e6e6b4cc67c5148a265eba0e61815d48ad91ebc
-
Filesize
938B
MD5f4704e4373e961459bb62a5d06d36a06
SHA13ae524d2f6b5ec83c20e378d6e0c5764e276d9d4
SHA256daed1871001185edccf1eae9d71fee0db26cfbcffffa910513487d72bf6dcde6
SHA5129cbf66f8d992103dbd4277904ce18c3601783d8afab937fcf8bb85d6f70b47511318413bd72f5555aeac4248ba033eeb26aeba4023552678c00e9a8b45d56ef4
-
Filesize
502B
MD5d5ebf05059b6f67696f45b2d924bba2a
SHA13e014ea0b4f7aa89e8324964bb8be44cdd02848e
SHA25674b7752871498001bed382289f0d06a4a34c87ef2016a2be1d40deab2e1d7cea
SHA51262290343c739293c5f39ffcfe95eef4d277578c3ea2cd4531e52af30b7a0c5b5ea0b66b764d7b3af3e78720fc63bec6b31067460ca2b6928bd5139219f556034
-
Filesize
520B
MD5e1ab3ec7c9014dccbbe0b9f5e96124bd
SHA1d7c69988332dc1ec753f0c6ee859967470629858
SHA256cb7d4fff88dbe9540a53f03f430413140df78140290fce09631391432d0e1b87
SHA512044569181feff0d4fea41a16c681fa02d4d320772a7371b3262609cd57e9818fbe2f075d9747fb45629b9ba31b180356d81a71081d2686d259d811e8aa3ba966
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB