Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24/01/2024, 14:17
General
-
Target
7274e5a2772dcdf37329afea7ec037db.exe
-
Size
1.3MB
-
MD5
7274e5a2772dcdf37329afea7ec037db
-
SHA1
c2596c79aa0697f5fe9d462e11b0f7d829bcdde6
-
SHA256
05c67b43e7f4e654cbe2ed454a71a570bfbf31f9dfc5ed054ffdf0435a54a75b
-
SHA512
63b47625c05960645871ed6de223059db19d6e8103697cd531d384191b994d85e9d06b435fff30b7e3a1e7c897029c02533a64c7523ba5ea3cc7aec50af06c82
-
SSDEEP
24576:F1osqlgHbYPPmaxCnQhcBsdLgp5BG9DjYv6KAqm7BMIlCmvG:/osh72TWsmA4vzAqm7BMo
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe"C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exeC:\Users\Admin\AppData\Local\Temp\7274e5a2772dcdf37329afea7ec037db.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD52016ad546600398b2dfa71d6b28d5e80
SHA1c8090c3989abcfe107e080e1d0c3f64b7e9f8dcc
SHA2567f067ee34d7af81e85147b8e124521e332a036b1c0da73148469808b25076f7a
SHA51210137d12e889c4129c8953d9307e90ef26c9e7a0f503d225f54d6e7a85dc9bc23fd1ecce6b05526f347366fef47898450e4bcc3d42db764bdfb35437709bf3f8
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB