Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/01/2024, 04:39
General
-
Target
76680318660deae3cbc54723fed97415.exe
-
Size
385KB
-
MD5
76680318660deae3cbc54723fed97415
-
SHA1
e47e3d0526afd3092e98ef1798b4369eb8bcc0e8
-
SHA256
27cefb0c375d6dad5a2adbf1512448d6f0a1f48cf4ecffdb331a05c7598360b1
-
SHA512
7fa493791e00f6c6765c67d18b4365463ccc7028493662789a189f8731309e3c63ca9d8029042f0768cc98da6e65edd589788b23e461051e6a5d74e6539243a2
-
SSDEEP
12288:ZBRGMUKOFQ+iZNxwl4EGei6GnYoCPew+keHIB:4xjFwFwsei6CZfwnB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76680318660deae3cbc54723fed97415.exe"C:\Users\Admin\AppData\Local\Temp\76680318660deae3cbc54723fed97415.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\76680318660deae3cbc54723fed97415.exeC:\Users\Admin\AppData\Local\Temp\76680318660deae3cbc54723fed97415.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5a4ecce9150fbe628aef9454316532778
SHA1fe3f5a96392b811e7f1d96cee08658c0f52fd441
SHA2564cf5a5ab076dd74115bc4991df0400cb21de2670f17efacd8ec55e087cfbfbf2
SHA51213c7c29747d0a4ca10a763c6b6f0b0948922c35dce9a1e5f6f0023c5bb0f70871fb29e22e58c249828f2170cbaa8290390de7a585e19f20fc991dc2c30eb59f8
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
380KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
240KB
-
Filesize
56KB