Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    183s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 11:33

General

  • Target

    173c1c4bc8288b09bf36c84f845030d2.exe

  • Size

    2.6MB

  • MD5

    173c1c4bc8288b09bf36c84f845030d2

  • SHA1

    2a893dbb8dd04579cbdadff737c4e384f7fe897a

  • SHA256

    0084b6efe2d6a67272e8d82f4b2193211c03481ec37d82e5191e2a9289f59998

  • SHA512

    28f1cc7605d0e983fcd01b5a8824b0a5d10dd2dd1fce67f22727bbfc2c9d989faf7a5d070969f65f9a1f088e0862c8b84d5dadc5d1ed935ca9af3b9eea0a9174

  • SSDEEP

    49152:dsoyGEUkf6MKbUPj5D9s3fZJe1+BMb1Fcxay3:66MQgT8W1Mu+3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\173c1c4bc8288b09bf36c84f845030d2.exe
    "C:\Users\Admin\AppData\Local\Temp\173c1c4bc8288b09bf36c84f845030d2.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Users\Admin\AppData\Local\Temp\173c1c4bc8288b09bf36c84f845030d2.exe
      C:\Users\Admin\AppData\Local\Temp\173c1c4bc8288b09bf36c84f845030d2.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\173c1c4bc8288b09bf36c84f845030d2.exe

    Filesize

    475KB

    MD5

    8d02c3ab0cf6a2ab4c74aea025f9b6d8

    SHA1

    ce618cacc2c8264834b844ecbd3888550abb02cc

    SHA256

    a3c753181a38ddcbdafeb427d89267dc8a9067292e0ff35a4ad19ad6a5241928

    SHA512

    ade4a0340d31d906bb00cfc29afd30e1e513d3c94f39bb824da074a1a3a67213a7739671b3709657303d29ad6a5a292becbd807874dcf9ead9b4f17b9723862c

  • memory/936-14-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/936-16-0x0000000002140000-0x000000000239A000-memory.dmp

    Filesize

    2.4MB

  • memory/936-30-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/4832-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/4832-1-0x0000000002110000-0x000000000236A000-memory.dmp

    Filesize

    2.4MB

  • memory/4832-2-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/4832-13-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB