Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/01/2024, 14:38
General
-
Target
6fade2bc1082210a9eaef5d79ba01ad0.exe
-
Size
2.9MB
-
MD5
6fade2bc1082210a9eaef5d79ba01ad0
-
SHA1
86d6239e940dfc864daeee1099af64183af8753b
-
SHA256
88bca1df064f334db6653c4c7c045bae00947cd6286aacab10417cfb8e4dae12
-
SHA512
4ee2f71b868f16cd56393d3c039e99a7b76fe329d8f4ea155d718e8b6d63d35d608417d73be75056c35f16fec7ed4e1530b6ec1335faa8b6301f0f17d9fd652d
-
SSDEEP
49152:tPBA19QTHyM9hcWhR7KUKVSuN74NH5HUyNRcUsCVOzetdZJ:xcO8WTuPEu4HBUCczzM3
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6fade2bc1082210a9eaef5d79ba01ad0.exe"C:\Users\Admin\AppData\Local\Temp\6fade2bc1082210a9eaef5d79ba01ad0.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6fade2bc1082210a9eaef5d79ba01ad0.exeC:\Users\Admin\AppData\Local\Temp\6fade2bc1082210a9eaef5d79ba01ad0.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5bf2f896336e5df8167aec320c9a5cbb3
SHA14688de4e70f79d625ff0859ea8e65e7d3b8f613e
SHA2565a6ed18f48e3f205f2f2b13f260f3eb01a73b6d4cd1522723b7f2d11c5230f9c
SHA512e02609bdffef19f6c176989bae90306ea5f75b18a4ed76ebcfb7ea68defd3cef34d401fb99072e249e1ee2cb36276f4e22faea08f8369ad92060ec66def14108
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB