Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 07:11
General
-
Target
2ce03b10720e4ce8f22371d0910a8602.exe
-
Size
133KB
-
MD5
2ce03b10720e4ce8f22371d0910a8602
-
SHA1
309d4752876853a4df8fad5e4966fca19c75b1d0
-
SHA256
c6959214c28923143da0e5c7c2c6f818f8fd02030d7aa1ffe202eaaa3d8a3033
-
SHA512
dcc9768eaedebea44ba372062850bbccfc65996180d25ce72e78847d889dd0679cc6a2813757af6d0fbf043ad6ac73ee5bda4943706c1ed6353b6286cdbbe51e
-
SSDEEP
3072:QVuVCl7Z3JUZJRdIAT8j9jpaj+yLI39lmsdS0b54ivGfulYKrzQ:QVuYHSRXgjpa1stl1yEGfsfQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ce03b10720e4ce8f22371d0910a8602.exe"C:\Users\Admin\AppData\Local\Temp\2ce03b10720e4ce8f22371d0910a8602.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2ce03b10720e4ce8f22371d0910a8602.exeC:\Users\Admin\AppData\Local\Temp\2ce03b10720e4ce8f22371d0910a8602.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD54568b9c3233d16908a874f0d95c14b5e
SHA13114cd1bd5e769ee89f797984b043210e8096055
SHA256d2cdc556c97f79d4947df46517ff8332b7e8b3a73b83bb6130192d20548fd189
SHA51209e153fb848632526b9cba25b78e4e8cf5c72b6b7aed78d6aaee012b95575c407bacd07d622ad9ac4a6946bec4007fb3a268a5f1df15ab533a6ce274f2f1c9e8
-
Filesize
132KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
536KB
-
Filesize
132KB
-
Filesize
124KB
-
Filesize
124KB