Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24/01/2024, 10:42
General
-
Target
7204895fa37d3bdf5251057d3bfc22c5.exe
-
Size
1.8MB
-
MD5
7204895fa37d3bdf5251057d3bfc22c5
-
SHA1
d6833ee61cfa588363b4bffcf0c0e46111ce849f
-
SHA256
713eea9771cd0fefc51af190aef8d3510528fa1a8210518fa8796d6baf816290
-
SHA512
90c5d3ef2676d0ec2c38bfa4c9f5ba3e167ccb4265676f7ce9610f97ab9933eed26118abbb5e3cf44e83378ad8de2b30d60e4bb4b3c4a52fd280b4a7b44b63bb
-
SSDEEP
49152:Gkr8oywQMFw6XUXF8tEomL9M6TIakVbhOwP:tywQc1UXXp9M6TIrthOm
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe"C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exeC:\Users\Admin\AppData\Local\Temp\7204895fa37d3bdf5251057d3bfc22c5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
885KB
MD53a8327cb9144ad60978d57d35e7a4acf
SHA1906d9aab3e8e6e799f2d14f9cce72fe1e2ca3179
SHA256693f3f728793f4e1d469ea384e19a4b72a8a9be4f9a5d5517246784385386d43
SHA512cdde76a1a4994d3ba65b9b40b0e07d8925e1e6fb6092d1a5f1e5d73d01cc66793fda2a1dd0472328988b3cd61ade5745d3d292098fede4888ffdb7aae54d18a7
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB