Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07/01/2024, 17:48
General
-
Target
49a6fb26582ede0ade82e0b9f7714989.exe
-
Size
56KB
-
MD5
49a6fb26582ede0ade82e0b9f7714989
-
SHA1
33a21b04eeadced2ca5b8a869b5a85091053cb83
-
SHA256
4b8a0c570746e57ed21195bc66353acf1740ad727dd5587309465ebaab79f7d5
-
SHA512
d26d96981f3feecff2665ccc928a5b08941d257f949c5e0950033dc047eedbb580905dbfe320c67af035e62e028fd3425460988aff3124c4fd8ea0b2e06c6614
-
SSDEEP
1536:ECnurieBzwDfkHWjFApNESnfbptwXf+qXKaE:EvHww2jmlfbptwX11E
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\49a6fb26582ede0ade82e0b9f7714989.exe"C:\Users\Admin\AppData\Local\Temp\49a6fb26582ede0ade82e0b9f7714989.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\49a6fb26582ede0ade82e0b9f7714989.exeC:\Users\Admin\AppData\Local\Temp\49a6fb26582ede0ade82e0b9f7714989.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5a7fc2bf3165c1cb3751ad30955379094
SHA1094eea5479c0bedc227ef3721de0959216d68982
SHA256d9c36ebb9c1ba82f49a75df4c4110c6de6f0bf1f0b1155b14f8157ac82a9e519
SHA512016b1c50d64c43db61df2dac6f1b572e84415d2cad30f03ee184acaa478a725fc910183d6c1c371a0e174586856d9ea2f800e4ba465484eab5f5e0a02afd7f9b
-
Filesize
232KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
108KB