Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18/01/2024, 03:40
General
-
Target
645f4ad4daa596e2dcf1216c43beb2dd.exe
-
Size
57KB
-
MD5
645f4ad4daa596e2dcf1216c43beb2dd
-
SHA1
ff707f8ad3968777f9f2af8f7755f93fe6c64918
-
SHA256
ebaa77ffec5274e94382118aaa95b3f2b26a38d73e629201d5d2757e839d6d71
-
SHA512
5d99b5bee36d202bce64814ce751b17624ac4d4a2b7f3b4329c6293729a959588046fc6ea3e2face916fa18b3ba773f551d29fa31168ca48fbd1a2f5d50f5e9b
-
SSDEEP
768:vAG3lS3K5F5T0+Z0ZG7NHK0Venu59vnhwyh36nESKbkCz/JgZwCaCgslV5Gi0JdG:vzksTzUlneHxyEFkCz/J8wuGj3+t3Z
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\645f4ad4daa596e2dcf1216c43beb2dd.exe"C:\Users\Admin\AppData\Local\Temp\645f4ad4daa596e2dcf1216c43beb2dd.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\645f4ad4daa596e2dcf1216c43beb2dd.exeC:\Users\Admin\AppData\Local\Temp\645f4ad4daa596e2dcf1216c43beb2dd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD58f07c1171ad02d175e42acdb5700dcc8
SHA1bc4130df1b80722f1122c5967fe09c7b95048597
SHA25604b9c5282cccc11e076458ce60fe06c990b31f324c6036e056feefbd17feee54
SHA5126af3442af61374e3367a70e45030b0109fb96317b9457923bda2583d39898c93fd5592d7221f977dca12bd5bc00d612e51c47a883c99caeb54949b133178b5b2
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
108KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
176KB
-
Filesize
108KB
-
Filesize
108KB