Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
166s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/01/2024, 12:04
General
-
Target
40cfe873754cb1acca2f17ece7571602.exe
-
Size
5.8MB
-
MD5
40cfe873754cb1acca2f17ece7571602
-
SHA1
da4a799919822850cb6f819778fc0a5ba933f1f3
-
SHA256
bf3e2432e6ab16f5717134b32cc2b936c1bca00573fcebc995b937648787e70e
-
SHA512
e2d2dc389bb7e959ccd0cffb665b325d9c9468e87ea750c129fac3d820369f8cc5ab8edb0daac73ef8b298df89da99852bf2d28a1f2456781197d989685a4ec8
-
SSDEEP
98304:JOKyO1C5PStp4HBUCczzM3zEgJSCgkxf0QIbLt6q4HBUCczzM3:JOeC5P9WCX/bqQataWC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40cfe873754cb1acca2f17ece7571602.exe"C:\Users\Admin\AppData\Local\Temp\40cfe873754cb1acca2f17ece7571602.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40cfe873754cb1acca2f17ece7571602.exeC:\Users\Admin\AppData\Local\Temp\40cfe873754cb1acca2f17ece7571602.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD57d4b7ecc67df8e8b8a6af96ddeb1c2c0
SHA176a1c42d541d309809a014c662b9879ff6829acc
SHA256f53167e56a16e52ee88e356de06ef3b4845d8d2c40de26a38b21be7a93bf1bde
SHA512031ab300bfb9bca9cfc29f5cd425ac37018cdabd1c55fa59629a3a65ca6d32b45d97c5fef6419460469d0b214a8510c4de05bb4b2ba6960fed62278cbd8b0494
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB