Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/01/2024, 16:13
General
-
Target
a268005fc16a2af341ded5b30ac0425b1d3cf0ee60d97e5577acdf5427d91dfe.exe
-
Size
536KB
-
MD5
76c560a272f628e702a6797e5e41e129
-
SHA1
5fea12847fdcfd24a485408f8446ba228c786076
-
SHA256
a268005fc16a2af341ded5b30ac0425b1d3cf0ee60d97e5577acdf5427d91dfe
-
SHA512
bda59001ec3e8c0f313a7f006ef57c7585beef5cf1efa6b49449f295c745835a3bffe9d8b4b3095b64f1570bcf776e906264e46d824a1c6f557b526cc8944af0
-
SSDEEP
12288:Lhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:LdQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\a268005fc16a2af341ded5b30ac0425b1d3cf0ee60d97e5577acdf5427d91dfe.exe"C:\Users\Admin\AppData\Local\Temp\a268005fc16a2af341ded5b30ac0425b1d3cf0ee60d97e5577acdf5427d91dfe.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD580e17988c5eca027973939ad41058836
SHA1c1fede9b842163f526f17787e069724c859a7a80
SHA256071a764756c51b540f60aa4c8c6d6f3581df057a935db909bcaf99b8aea4729b
SHA5125a7b517b9bb44b563904788896d16092acbef165d585f81f3f753c604dfc376d08c6dba77a842284dc63eca96ca1767e2eddc01a7f626ece5a7fa14b9630cf95
-
Filesize
938B
MD51df463ff7596107c9f8d9d640d50c58a
SHA13f30f19bdb20d064c12b933325ce1c03b775f4a2
SHA256c1edf2279c8f750b92cfacafa86c5639a231b3648c15d270b0cdf3f983bfc0d0
SHA5129c5e7a1c3e6d3acadc1be21620dc12d48d19260121e6551425265d8bf7bf7d08691a8c62ccedfea3e0ef67aca7cec3c1bd39cfb05b05d1705a46634bcd38f4cb
-
Filesize
502B
MD57f27c367ab81189dd3703854bf360e44
SHA10c12dc15ff2a90622bbdfa194355cb7edafd57ae
SHA256423726faa9c542eb5d6005810e93511a6859ce34ccbdb4edcedc2210b8506215
SHA512677098d5aff941c74a46fb4d7852be193512d1fb89d0dcd2bfa232272bcfc7edf52477e7f091bbe66a57b8684004884c079c7fa41fcf678dd637e995d8ba9a64
-
Filesize
520B
MD5fc91fd11593d9fd7ea6933b6c6c2f97b
SHA17b7c5aefcbddb1abe5023c5acdbb12df27d08e27
SHA2566733b75d11f2ebe8777040857d92f395e7c5196514cff8955828858294bc97aa
SHA512390cc7f0ba5087f65312d8964263f5c16545c1c0def4328c4d99e1523ae03f0229f7a58a7de3bc9c2a485a1df217502411c3ba8d06ea8ce813da0636627bb19f
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB