Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 21:50

General

  • Target

    49dc29b126d3ca34cf92b57547364a55.exe

  • Size

    115KB

  • MD5

    49dc29b126d3ca34cf92b57547364a55

  • SHA1

    e87af745bbe21dd2d2d2fd6704ac3aa68fad445c

  • SHA256

    b4b77c2194be11999c98009b40b7b3f280b6ea0667ed54ba2704698fef2aafe4

  • SHA512

    0591cb50ea0a6145f1b124d900a29e0153b7d858b7573999310ad1346b7d8e55ced9f837b78b6565a17ab70d15f461a100b0d3f55d8bcda536e3eb3eddcf0746

  • SSDEEP

    3072:Dwht8xpIjcNUWvnPU7pYnMXXnRUxKHPYd:0jMpIjCxv87ynMXXRhPYd

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe
    "C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe
      C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\49dc29b126d3ca34cf92b57547364a55.exe

    Filesize

    115KB

    MD5

    c2fb339eda3509ccc2aa579748786d24

    SHA1

    5bc85f371c13adfdd47ede681ff10e0a406f59ef

    SHA256

    308851a098ba561be4a9259a3f0488ccfa69aa31220a1cbad7021c733b022afc

    SHA512

    696a571602767a933b7bcc8f122caee596e4f390f803883a8864c03ccd339d3a49b29bd0af9e679025dfeb2bab6a0e660071c236f906c9b86bf3e11bde375cdd

  • memory/2728-14-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/2728-15-0x0000000000190000-0x00000000001AD000-memory.dmp

    Filesize

    116KB

  • memory/2728-22-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2728-27-0x0000000005190000-0x00000000051AD000-memory.dmp

    Filesize

    116KB

  • memory/2728-28-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/4812-0-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/4812-1-0x00000000001B0000-0x00000000001CD000-memory.dmp

    Filesize

    116KB

  • memory/4812-2-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/4812-13-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB