Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 13:41
General
-
Target
1a5a2351fd1866518d84fa69d9e850eb.exe
-
Size
2.9MB
-
MD5
1a5a2351fd1866518d84fa69d9e850eb
-
SHA1
dbe9a30df41fac897f622d5114e60bef98a785ee
-
SHA256
38bf40d8290a1160eaf51432810cc60a76db498bf6351919406f3375aee3f6c7
-
SHA512
7d7365f8b0041752d7af7068d9e25048ca5bd3569821b4c32a9acab29cd9ce8ad0c4d48e0e5acef151ea225e8942784f09072636a670f3809603c898fbb4c103
-
SSDEEP
49152:Iw7xM9pM/UBMaBjndAPGITVCDuN74NH5HUyNRcUsCVOzetdZJ:vsM/UFlni6Du4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5a2351fd1866518d84fa69d9e850eb.exe"C:\Users\Admin\AppData\Local\Temp\1a5a2351fd1866518d84fa69d9e850eb.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a5a2351fd1866518d84fa69d9e850eb.exeC:\Users\Admin\AppData\Local\Temp\1a5a2351fd1866518d84fa69d9e850eb.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5eee64c9d31837041823508baa697b331
SHA140a509ca52ee13755d2bfb4acf4c16c2ed8b5d4f
SHA2566310a0e4de1e7d2ee15b29c2816795dff25b296edfa4381e1504615f941ad879
SHA512ff515215110ce3c65a1ab053ea56ec2b150ff3059ac34034f34dbfc64131cf1988030356103450d55eebf6dc38534370a6c291f5a31193ad647cf6aacf22410c
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB