Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/01/2024, 11:56
General
-
Target
cfe91a264e83dee338744d9682a528326acaa539c925d30012e239e16d1471fe.exe
-
Size
536KB
-
MD5
783ae7186b8a57ab5fc50db3b5a05777
-
SHA1
9e9d111b16b824f5627020e52e685d3fbe1483ed
-
SHA256
cfe91a264e83dee338744d9682a528326acaa539c925d30012e239e16d1471fe
-
SHA512
4575a4e0e2331d4837dbde9dd1e79c27aed2b92e0fd89dc6971f989a6abfef62e762e2f0a4020c80a7cb5bbe95b8c96f9eae91ee613148cd6c700b7325a63adc
-
SSDEEP
12288:/hf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:/dQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfe91a264e83dee338744d9682a528326acaa539c925d30012e239e16d1471fe.exe"C:\Users\Admin\AppData\Local\Temp\cfe91a264e83dee338744d9682a528326acaa539c925d30012e239e16d1471fe.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c723ee6856557f0bfd1cc5e67b553d05
SHA13a78610a0c88153d0f6f5b78640a6e6be4c00090
SHA256965a8fe70760f2e36dde21daabe53e847bb56c53a850e6e6cb37238cc9963281
SHA5122693cc09b2d3a63ff4ed2fb331a1e871e33317959da68b2e095ec986670f5aaba620d44be5e5d79c7471e8c642410ec7f3259452898dd4a4b2cc5e556d2f1bb6
-
Filesize
939B
MD58fae162548fda49d1fd8a343356c191e
SHA10a85f178464e461e566d827985974d379e434d15
SHA2562195f0b4a24a2ab39c72931875473d38cdc1d6d33eb9257072eea8c5052647d3
SHA512fbbe6dc04f4b583bcf441b160138ddeee81112864e784cdeb79256e1377f30732d58b2e450156899b02e35018a4a2075d8edce451fc3b3894aab77a336b06a92
-
Filesize
502B
MD5fced62cfa66c172d2fe34b83fa029855
SHA135d54100bdc40b55b2a48a20519918fa7dc1e92c
SHA2563794d35c1cb4d1d8601b73bfaa262b951f101269a3e9dd9efad071d30d556083
SHA512476920c8bac57f181451e926070bbf2360f75dc94c3abef477e1382f0dc1d21db1dad3051677126503ee92d9f3e390d827822097247e88161f43c16f67196254
-
Filesize
520B
MD5803335d3a97376e96c270f7c21370b46
SHA1aa20af22c9e7cb5c9bd54060ccbf861ceec981b4
SHA256f3469f7d8febf5be43bb5cea6233e6bcf470b8bd825c8c9772ac9e4a86e6fb63
SHA51252bcc1cbfd99a79388a6d3b9f715b5c2b65d4195f6aa84e2497f20b6ef52995d52e77c19c554e86563f3626a19fb63fb39aa0b37f1b2964935bdfb633a564558
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB