Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 13:11
General
-
Target
5f4033c7688d592e043157e06af1301adedc8c3cf07d3120c8c39da944a32b6c.exe
-
Size
536KB
-
MD5
b730bfe1c6c0c5f14de82da2c3d1d040
-
SHA1
c7858fce16b6cf223e53c3039af6ddf9fbe6fbfe
-
SHA256
5f4033c7688d592e043157e06af1301adedc8c3cf07d3120c8c39da944a32b6c
-
SHA512
38f040936543410f562f78d046dd0f1e4bb25a3702d1d6fd9adba3aa2cb6d7020a598962c708716f5f2184388aefadab3e4e71f504d3a58993e4a9af2b13efd0
-
SSDEEP
12288:ghf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:gdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\5f4033c7688d592e043157e06af1301adedc8c3cf07d3120c8c39da944a32b6c.exe"C:\Users\Admin\AppData\Local\Temp\5f4033c7688d592e043157e06af1301adedc8c3cf07d3120c8c39da944a32b6c.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5546ffcad0416c555276c939c26529c14
SHA1c3bae4c4ab20d1f6a521561ef4ddb2f2ed938998
SHA2566776f85d82b590deaa225251eefdcd4576fb84b1c2156b93a60f4d8cc06ee070
SHA512a69e2d363919e14cd42d54fed99b6b32bf567175df51e0bd1684d0f621900997e2c27d3c358966509156d3ac431b4518abe3aba63876fedbd6c6a0802c5d8c04
-
Filesize
939B
MD517b9c98d0ce6b6fe87cc63f06195ee27
SHA1b9278e370271d09bea0a48e644af7e681604458b
SHA256a15fc92ff66886df7d5f65cd8bbd22d408653b17cd90931d0569f2a971e6b9bf
SHA5126d2be620961345a718d96fdd6558bf14682cde86dabb3ef3f69794c77a5e05920947c5df33a2632c5e36324573d89af261babe91bb0d85b2864cc522a3ef84de
-
Filesize
502B
MD5d34c8343ce2030c52f2ce267ba5045a9
SHA13d4abc9a8629c464adc8bf77c0a5fb6267db6d02
SHA256a54f01028ae84d8ba0f1db6c0076ba294f0a0a8176931381da66c3f72d4e36b8
SHA51202138e10e3fa452f48a031d66b93b47044490fec8aedb2758a29c88e6222b25bd38ca4c585d03653a3065439bd9aacf7b71294ca3192879003f48e92e04fc853
-
Filesize
520B
MD595e7516b408bf9b9ebbc5ce7b147b23d
SHA10d4c0700f8a924f328393080470b1c2ff3a2a603
SHA25645cc6dc014ec32f316e201bfbc5396b6d3cc35ac3c817d67a6605554715205a5
SHA51245a1470eb7104c42c8ef82c2229425991774c41bf76e682d542bd8a6b531f127cd81de986df74b5d2743ee1b9bb2fcfc5804dd0d0ad3676551586b8e948100c6
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB