Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
06/01/2024, 22:48
General
-
Target
475e87bb7b1047b1a965552d3a8781a7.exe
-
Size
227KB
-
MD5
475e87bb7b1047b1a965552d3a8781a7
-
SHA1
4f5c49574e7a25b764790e42c7904536a3eb512b
-
SHA256
e68deba0d2497a138ce521312732925a031593f9af08d518b20eb794a6f8ecac
-
SHA512
fd49b21902d3b6e2a9cc690243663738ceac65095aaab59580e15bbd928e1c2c189bee83b8b4876090fdf1a2dbbe9a91a143fb9c56c4e04f5cd6a78d20fdad76
-
SSDEEP
3072:MbQi390ezV3Q7RcaDryukKLeC1TkGNmCjxqX/fI/x0s29ygBqQkmDRK:MR39JsXryukHCRXmCjxqX3LZBOE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\475e87bb7b1047b1a965552d3a8781a7.exe"C:\Users\Admin\AppData\Local\Temp\475e87bb7b1047b1a965552d3a8781a7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Openua.exeC:\Windows\Openua.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5475e87bb7b1047b1a965552d3a8781a7
SHA14f5c49574e7a25b764790e42c7904536a3eb512b
SHA256e68deba0d2497a138ce521312732925a031593f9af08d518b20eb794a6f8ecac
SHA512fd49b21902d3b6e2a9cc690243663738ceac65095aaab59580e15bbd928e1c2c189bee83b8b4876090fdf1a2dbbe9a91a143fb9c56c4e04f5cd6a78d20fdad76
-
Filesize
362B
MD5ba8455b8c302d4cc51c3f3e09658a824
SHA1365474fbf407361cb16f6bc122303f18be2747bb
SHA25643f5192f2bf41fef36cd3c4af2cf7d51432e9e10864e1175fb27838eb703df22
SHA512b91331fc4aff721ff05508ebced4b22fbfa78bf9d6358dbf052d52b39e6b11c21cf5f8857d3e1bdbffe59a35c9042fc60e1c858a6f83da1f2e8d7e8900a2caab
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
4KB