Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
34s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
10/01/2024, 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4fb9b826c712754a09252ecbbe626274.exe
Resource
win7-20231215-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4fb9b826c712754a09252ecbbe626274.exe
Resource
win10v2004-20231215-en
6 signatures
150 seconds
General
-
Target
4fb9b826c712754a09252ecbbe626274.exe
-
Size
385KB
-
MD5
4fb9b826c712754a09252ecbbe626274
-
SHA1
fe10be8e71ddb89ce2daa865a6ae8b8e4cb754ed
-
SHA256
2fbb187497457b3142e79566eceac73daff5013c47589ab2889b85c6fa29eb3b
-
SHA512
df7eb7312d7d0d4798e189cd83928a3b62bc6179a9aba56d7512e49ea56e1314f387fd00bec4a2b6bf79b9188e5c7d2c75c13009b817e6b31b2596746596e0a6
-
SSDEEP
6144:SjIZHaPCf/0xeGkomMuL5z8b+N5NvXh8cm7zBsGkAPPPWNmfM1B:SjqHaU/0plmMCV8b6JXmV2Nmk1B
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3824 4fb9b826c712754a09252ecbbe626274.exe -
Executes dropped EXE 1 IoCs
pid Process 3824 4fb9b826c712754a09252ecbbe626274.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious behavior: RenamesItself 1 IoCs
pid Process 3936 4fb9b826c712754a09252ecbbe626274.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 3936 4fb9b826c712754a09252ecbbe626274.exe 3824 4fb9b826c712754a09252ecbbe626274.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3936 wrote to memory of 3824 3936 4fb9b826c712754a09252ecbbe626274.exe 15 PID 3936 wrote to memory of 3824 3936 4fb9b826c712754a09252ecbbe626274.exe 15 PID 3936 wrote to memory of 3824 3936 4fb9b826c712754a09252ecbbe626274.exe 15
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fb9b826c712754a09252ecbbe626274.exe"C:\Users\Admin\AppData\Local\Temp\4fb9b826c712754a09252ecbbe626274.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\4fb9b826c712754a09252ecbbe626274.exeC:\Users\Admin\AppData\Local\Temp\4fb9b826c712754a09252ecbbe626274.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:3824
-