Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 13:51

General

  • Target

    38b3d34bbea87fc0f1a0eca810f3cba1.exe

  • Size

    5.1MB

  • MD5

    38b3d34bbea87fc0f1a0eca810f3cba1

  • SHA1

    5bb4a254de93a94c4c22c23a95d37e74182261fa

  • SHA256

    b22718b1b2fcbdeb02059be209e8011451667e4ddac2dd3a27e18fc45d7d213f

  • SHA512

    8c597dc5fc965321de25211a56c4c9fa1e4c08b66e66cfb5118ab8b77c23b89500c89c24bb63e997040d3f736309577b3c70fe43806da00378b33ea255d7d9af

  • SSDEEP

    49152:wAMnlFgA8cHiceXtEE8SyZ7e32vdo38E2cAL4uobPNoay3b8D6uGYLdi3PX3CNz0:MPPNeG3/xobPi3v4psdcnwMgb33

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe
    "C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe
      C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\38b3d34bbea87fc0f1a0eca810f3cba1.exe

    Filesize

    162KB

    MD5

    11b05196d6748492c5aa719faccd5b83

    SHA1

    b470932c0141ba8c988cdbc575ca024dcbeba097

    SHA256

    57f00f4459650de348b9b59aa161d83d3d51f5a891e60a47077ffed6e76c0983

    SHA512

    9a81f284841f751b284dd6281e682093ef317b62157e0a24aa423f61e54d1ab00ef8535e2c3e84a8dbf11003cc13e09504516df35c7159dd7bf5938356d2de02

  • memory/3012-14-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/3012-16-0x00000000022D0000-0x000000000252A000-memory.dmp

    Filesize

    2.4MB

  • memory/3012-30-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/4340-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/4340-1-0x0000000002270000-0x00000000024CA000-memory.dmp

    Filesize

    2.4MB

  • memory/4340-2-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/4340-13-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB