Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
05/01/2024, 08:04
General
-
Target
432dc6580aaaed0deb565a1969091642.exe
-
Size
2.6MB
-
MD5
432dc6580aaaed0deb565a1969091642
-
SHA1
ff9843f28b7f6445f3311ae671779c7c8649e220
-
SHA256
dadcd58cb35ced24211571eb6ba85e5d8ff977895121632ca86268adc1e9c5a0
-
SHA512
f6055d37b8dc2adc17d728bb3fbb7b85d36db218d97d47c478560018d29140b95e1840168113f385d55010ff3927674b69616dcfd916be4d68875e3fe33c5fa7
-
SSDEEP
49152:TAvqNAFdcHVhHNH+kmGbfqMH0/7u5OTtFXay3:T0UH5xw7uK3
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\432dc6580aaaed0deb565a1969091642.exe"C:\Users\Admin\AppData\Local\Temp\432dc6580aaaed0deb565a1969091642.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\432dc6580aaaed0deb565a1969091642.exeC:\Users\Admin\AppData\Local\Temp\432dc6580aaaed0deb565a1969091642.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
-
Filesize
2.4MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
2.0MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
2.4MB
-
Filesize
9.6MB