Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2024, 06:02

General

  • Target

    5c516539e6aa7d2ce2a111afe96adc85.exe

  • Size

    266KB

  • MD5

    5c516539e6aa7d2ce2a111afe96adc85

  • SHA1

    b30df0b33bec1fe8823a384adba635930562a811

  • SHA256

    d50158048869b5d6ff9cf8d5a50bd730e9b40d112cb6eff9f381b6e8bbc0ec95

  • SHA512

    cdb2d9b14e032654bb5da41c6e0ad7e07e4ab7a20321e922b02ca085ccb400106601616793039574cf05cd78c7583ba0cdd428c52f40c8a18f647a81671f5f2c

  • SSDEEP

    6144:fb9PFro5jwssrPBPZHj0D6kivBtcbBZFeE8Tzg4zI8gAhn+XghImCSQ:brzvzBxHID6l2JX8vgSITApImC3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe
    "C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe
      C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5c516539e6aa7d2ce2a111afe96adc85.exe

    Filesize

    266KB

    MD5

    46c6766b2e56226ebdcd492c7bb662fb

    SHA1

    9ab769ef087058954417f641a382b8139a3861c9

    SHA256

    88bdca9f2aa3ed26d0bb30b80e5639a99fe7cfec20c3fcf572cd6c21ec9f1028

    SHA512

    ad5e763ab6420c24c296444d5a2ef8cbc3cfb52025e697a5c64d8e51bbd50d5af23f39a04a710fd44d4e95b2b6aa8b1517a40551796a27ee753235d89755a6c0

  • memory/4724-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4724-1-0x00000000001D0000-0x00000000001F1000-memory.dmp

    Filesize

    132KB

  • memory/4724-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4724-13-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4996-14-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4996-16-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4996-15-0x00000000001B0000-0x00000000001D1000-memory.dmp

    Filesize

    132KB

  • memory/4996-30-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB