Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
164s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06/01/2024, 12:16
General
-
Target
e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe
-
Size
536KB
-
MD5
bed29bb681d99164fe95fed1a02a7310
-
SHA1
a02e64da076a1769361b4f7c2523ee0e012d4c5f
-
SHA256
e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc
-
SHA512
0284095b13bfe991f28f8cf63c006601c06b7f9257f3c8cbdb88418eb1ddd32259fe6678d4acff74c0cb6f6fa0e09d0b7ef36f2715cd0f2648ce892486ef4180
-
SSDEEP
12288:phf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:pdQyDLzJTveuK0/Okx2LF
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe"C:\Users\Admin\AppData\Local\Temp\e70b003d9319000ca32bbd5e8b5fdd7a00969cc249e1dda3cd133247d2657ffc.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50f7284d581cc2e23607d4c9819717e19
SHA1994bc92c6c7bdb08851b4b158f6169c6f4386bf1
SHA256bebc36ac5a37a509572f4d0fbebeee65b65eacb175878e850e8131c0ecc824c2
SHA512088eb346e5562637256c8544b76955a5678473bc74785276bfb1c375ea605011f26a460f2730575350100e00ba0e86374eb7ccabf855836219ff00739f0e6c97
-
Filesize
938B
MD5c3a1ad003ce7168886937c70919b481b
SHA170e982db3798fb47d64ae1a02cfc37998e089b5a
SHA25637d97381e7d6823f1342987ef5a056200b512ef69b98020617986b0ff39f0a50
SHA512c8a0da1665552f53b79fdf7514d09115c78ec311ab90721053aa1690901496ea94e6bc79dd8eb92663410825a6bd3af413e7550ebc263326fa4f7917eee83cd0
-
Filesize
502B
MD5773a1d5fc53d27208ce91a4b3671f05e
SHA15cabe6ea360ce3dd8dc3fb0d2ae59a50d596dfee
SHA256f4ab788a8cbe10371d8fa35672d921c510f8b5224e7178b40d0b8e40f3e81255
SHA51247a7aee7ee97f6ad3f7cd868913dc314dcce19da7db11e63fe4cf1a706f72768268a3501f63ffa7b7d4eaf001ef7d5a55ca01b0368ab638c39480f2ca533c79d
-
Filesize
520B
MD59ad7beb0a755c8fe5d285de385709d4b
SHA1539910cd250638192c1c00bd364aa24e3adef580
SHA256a13200569c511e3a70a2093bb8825233f0cf547e6e521a49c6c1dada18581d01
SHA5126271f8992ac96e56f9df6db6d7099b4b6ef9149b62d94e86b1894acfd5d60e38c6ff36b59ff649ada3bf2b7f71536e603b6f9ddeb0a0c2baf800891cf5d85450
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB