Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07/01/2024, 11:52
General
-
Target
48e7ec0cc2541869e82ff7b3ed89698f.exe
-
Size
1.5MB
-
MD5
48e7ec0cc2541869e82ff7b3ed89698f
-
SHA1
0983ba78d6c543361d0ded38b042038ab94af403
-
SHA256
bc6cfba885b8c5da3cafac49eb739815b3dcefb6a9672a6d8e0b70f6ec83b6c5
-
SHA512
0700b0018f0b2819714b5cfde5198ebcea10d7da0debb47e06456419d8ad4b27d4e75aea8d4523cf9fbba167acfeb6d2cac678eca7e7f11eb4b1d89c9b4341ab
-
SSDEEP
24576:sHAcPduj4BHn0MIuchhyDuCLkZATWJH5I48/ppx9MrW:sgcPduOHn0MfcPyUZATWJZj8h39Mr
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48e7ec0cc2541869e82ff7b3ed89698f.exe"C:\Users\Admin\AppData\Local\Temp\48e7ec0cc2541869e82ff7b3ed89698f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\48e7ec0cc2541869e82ff7b3ed89698f.exeC:\Users\Admin\AppData\Local\Temp\48e7ec0cc2541869e82ff7b3ed89698f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5e715cc8f731c6b194c1b4f1ba325c983
SHA105a0512a09d6995beb6cb9054222a965fa1be3ec
SHA256302f5cc5d4d9dbb3047bfb9784e333208dab44983c50bc8e4024be006d5ec4a8
SHA512e7bc82034b5b0fc9358102fa28f1c55e11df1b056ebb4a6e0ee533416a98a23759c1ad124c96c68028b3cdd6f15658d30d55c22564fdb000f84e20a9016196ee
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB