Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06/01/2024, 13:27
General
-
Target
06074b510d324c11e0d94414ef88ce1314b5cb0f49871ab928747ac0d344fb62.exe
-
Size
536KB
-
MD5
6644fc85b945ff98c865f185e3e625f1
-
SHA1
8519f9499476a4c1ce1707c13c9c574da32291dd
-
SHA256
06074b510d324c11e0d94414ef88ce1314b5cb0f49871ab928747ac0d344fb62
-
SHA512
878d16d2ca3983280d5ba7cc0b097ddef0ef131374e190c78b735ec380c3d6767ec38bb7cfe0fcc128d43c6e100c2bc77c9293a1df752b883c3b91cc099afee5
-
SSDEEP
12288:7hf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:7dQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\06074b510d324c11e0d94414ef88ce1314b5cb0f49871ab928747ac0d344fb62.exe"C:\Users\Admin\AppData\Local\Temp\06074b510d324c11e0d94414ef88ce1314b5cb0f49871ab928747ac0d344fb62.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d85769773d72bde074bd3ee7fbea5ac9
SHA1328f6f59dfe3b8e5c77892c99e510a825a98b57e
SHA2561d7af3b6f2f8d19ef3b50a5e7e56eeabc19e1d9c23e526fe9b6c6d959bcc9f81
SHA51235fc244d41d270d2b4d321fd5695ba77f55c9159a6a8c9661cdaa624f54197ba5c5045bc6e3d985b33b6caa16b0e8ebc6ad18c719d594591174b61de1c74955d
-
Filesize
938B
MD5c3a1ad003ce7168886937c70919b481b
SHA170e982db3798fb47d64ae1a02cfc37998e089b5a
SHA25637d97381e7d6823f1342987ef5a056200b512ef69b98020617986b0ff39f0a50
SHA512c8a0da1665552f53b79fdf7514d09115c78ec311ab90721053aa1690901496ea94e6bc79dd8eb92663410825a6bd3af413e7550ebc263326fa4f7917eee83cd0
-
Filesize
502B
MD5249acb47467c23ea18b2ca6e18fe3a21
SHA111999a218fee4f19ace71ea490995a25369dc8ee
SHA2568694fc8201ed8e6bc19d9721853b33484145c64ba74b6033d5d8bd987e4379a3
SHA5123c12ac1a2404af451f9e65e1b4a411b9f26c02f12d06bc1d992929239c372d77956d4041193d9fa6bcf5b7bb18718d9288316f2fcbc00cc589e4631a31dd2a57
-
Filesize
520B
MD5e687f90371ee83c39cb79c8a31a3b324
SHA12fec346ec124e04aea0a60cc4e0f9ae8d34eccde
SHA256c0ac1b193867d042f32c5a573972fac5e1c821813b5195fdca940174973991f6
SHA512ef5777dbdeaec07ba86ce4edfed85e38b37ef15ff4102fede3d3cf5843d99c8d509012c640379df1b5c63d36f492c963fe9cc7c4aa1b3f28b0fe4a9af7319ce4
-
Filesize
4KB
MD5bfaf668ebaaaa42efae6a40040f1e6a3
SHA1bedc347d22817f98eff6db27bc0fe288d813f020
SHA25690fcd981c25a34cf44f65de813cb4ff550c666a09006569960c9627be077469d
SHA512966771de9e158bdc65f293b988cab2b5c2250403ff777f968063a95eea4f213b39ebe4239d50172c50cf37565a128019226c3d8c2351b1ad69cbc162d9abebe9
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB