Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/01/2024, 10:45
General
-
Target
747e325310d2e47faae365bdbb4b2893.exe
-
Size
1.5MB
-
MD5
747e325310d2e47faae365bdbb4b2893
-
SHA1
0853bedb497e81fc101112081333007976a970ef
-
SHA256
ff5a3f602599b9b3dc809f3932eeadd0c9c47e64c3dca820073febddb195e6bb
-
SHA512
659a3654cf35160711e85c92fe8ae7245f1c551ac458600b4356e116f01c2391af8d8a145cc4e3ac3ffce7ac8ddbe3c81cb1ef5201fb334c638f4aa45b1da9de
-
SSDEEP
24576:gQqRSuI9K0/g6E8kZIFzNotmHuuQ0z73fNrbPhLl/UiEIcAnW:4UP878+Ivo0uR0nfFbZyiEIcAn
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe"C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exeC:\Users\Admin\AppData\Local\Temp\747e325310d2e47faae365bdbb4b2893.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD59952efaf99ef2f6c4452446c83726900
SHA1a6e01024e460d30cf2acd2954a05ff4bc0a2715c
SHA2563f2147d3570e4662708607ad3978c945573320f52e1deb90ca04538efaa9300b
SHA5125d0d10b009d51a68741f17bee5445cb1d90ef5a702322431420eb38e83d52ec6c48e29a69f7399c8f12da637230befa8317430994da191267d5ceba7ad1ae17b
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB