Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/01/2024, 11:48
General
-
Target
445d0e1307ca1a6b6b31ae601b5a4de8ad3ef7e3856eb73b7b59c97da81251c5.exe
-
Size
536KB
-
MD5
4b48064dfad2e090e9c4d44bd6c85938
-
SHA1
2f995dcc101ca2ec5079a721ba5aa77cf367abc0
-
SHA256
445d0e1307ca1a6b6b31ae601b5a4de8ad3ef7e3856eb73b7b59c97da81251c5
-
SHA512
aafd468ccd49ac816795c0a55572c09aa1ac612f06e245a17126f52bbb20fec546863a266c1fb49077fbf975ace225bb1c8e6ee32fe604185d972da367bc1b3e
-
SSDEEP
12288:ohf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:odQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\445d0e1307ca1a6b6b31ae601b5a4de8ad3ef7e3856eb73b7b59c97da81251c5.exe"C:\Users\Admin\AppData\Local\Temp\445d0e1307ca1a6b6b31ae601b5a4de8ad3ef7e3856eb73b7b59c97da81251c5.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bca141c829ab3de0ffd7340627ea32bd
SHA1f06aeed3a48313efc664a0fde3fc02672afb15b8
SHA256e5f0b3467aea2635aac968f6f191ba7931551157c4f37b8870fa5cd63fa3e32d
SHA5123e0a45c82a27b58b8c349348a7339b611216b23ee5bbed0e36f3b9e1f82793aa70172f6acc0d7b472397db7d35d600e72d7bf9ff7c5cdf4c45f657899c7d0248
-
Filesize
937B
MD56367d3a9d479080cadd998dc36a4ea77
SHA140b14e15578298cdf3915849aa82e51ec5a8d7de
SHA2564a040f65819bcc070399f709aa14d20c7e11644be54b3016c1d6d85d837b9cda
SHA5127a404a3e164b57748b8e64484268622c1dd5023d2921d3620470f280e5d307dacfc117f00ec7a234debe4a0ad54266e65cc71f8a945c84e2083821e74daed7e2
-
Filesize
502B
MD50b66611a4ab7d4918cfefe604f2e4329
SHA1fff47b2577af5be4fc1b7522fb6f1db72dc9fc95
SHA25691e6c16245d3cae0a746854ada5c40532b113bbcb87471e8492ca364e8a1f457
SHA5128e5931f94cde1b4c94fecb3b9723b5a223d7391bbd2676eb95bf4f9f3802dc43ce8ff7fc4ea76f1dd226163a01556d13d2652c3c3a1d8ca6d6cc7e2ea552b5ca
-
Filesize
520B
MD508ba01f6b958807b1457ef0c3e968609
SHA1ce6e64c1380e35c076157e8e6c011bc6b1e66a53
SHA2562815ffe3c2877fa82a8f1472ed846a65c97ee9f8cc48e39047aa635d4e5fc878
SHA512e0bb49a785ea067068f1c0d574b53715a2249f56cb4bc2fe2e320c7442fcca822edf439c671da68408a1dcd77da8701b742d8aca2e7d0023fccadfebae073b4d
-
Filesize
4KB
MD5dae8e6ec3110dcad403004ad507adf57
SHA181b1e0e09b2e55d64a09ecb5e5147995c521cd14
SHA256c7ed0ad5882a1c16fe4121f997aa82e6cf8fd90a5c182b988b3b743c556d9503
SHA5124f7344a13894b9a63074c0ddfe1f07d40690fa0cb45420a2265c6ff7019618fb34a34b0c69f36d7e90bd90610a3e22b3a6868d393e33ecc9f11cce19840ea71e
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB