Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13/01/2024, 14:40
General
-
Target
58f7cca4132b606fd7bbfe36fa83c775.exe
-
Size
1.3MB
-
MD5
58f7cca4132b606fd7bbfe36fa83c775
-
SHA1
a2b0e9a63e2b5b470d204e58fea7c45f62993feb
-
SHA256
2a9ea8d5aef32276b31cd81d59eb9e82573f5d11d08442bb150b0ee8809b17a7
-
SHA512
30d5f6f4271f012d504705f389a783ffefae5afa840b9c119540d95802681433bb21ef9bdd442a129dd59f895e2901148833160f5e75fdc231b1c3abd8cbb88f
-
SSDEEP
24576:nsmSmTiluvKC+PUkqlT73Zz99iUP4N4ZdiZ+Zur2U9/9Us:nF2UkU+4ZdZZurpR9j
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58f7cca4132b606fd7bbfe36fa83c775.exe"C:\Users\Admin\AppData\Local\Temp\58f7cca4132b606fd7bbfe36fa83c775.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\58f7cca4132b606fd7bbfe36fa83c775.exeC:\Users\Admin\AppData\Local\Temp\58f7cca4132b606fd7bbfe36fa83c775.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
177KB
MD5a9075600d800632f2f1a4fb32bfc9965
SHA1af4559cdc46767a4a72fb20bb237522c09ff0402
SHA2564e46080f8b6fa2682344d64dc15e92586b6651cdcbe416926ee8ab833f0bad04
SHA512babff367cf58041e1ceb68f3099191674f175f2ee9ea671218522dce430b370a71c9d5e6251e72734ca205df9e8cadb12611d462d442065b814d35eec8d42748
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4.9MB