Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/01/2024, 23:54
General
-
Target
7b9c9cf03e3512c011633325ccd89076.exe
-
Size
5.8MB
-
MD5
7b9c9cf03e3512c011633325ccd89076
-
SHA1
001c5f763b2ffc65c1c8abb427093078bc3dcdbc
-
SHA256
e45e6e53c4cffdf15d202074d0f8f9580aabe998856fdefc27631962908faf23
-
SHA512
622a2461bc84d25d766a41055f0f2ca1307bb39ce3c333af9b9f4d63114343efe0d2ca070f0a338e75d097e621798983b400545f40681d5bde4f2af7418def4b
-
SSDEEP
98304:3GseY4HBUCczzM3RH8Ae75uIXTv64HBUCczzM3:3GseHWCdOuIDvZWC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe"C:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exeC:\Users\Admin\AppData\Local\Temp\7b9c9cf03e3512c011633325ccd89076.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD5caf91f12efbf4559bc749c6f7da75642
SHA148444ffbe5e47d6d09b8de3aa9d36e7bf770c565
SHA256d154266ae6ff3a0e9897556c3c158e9360c095c05e5cf68ab0bb16a4e90a6940
SHA512c219a4fbeb852cc87b8f1e0ec9e2d40f37d201130e1897343bd9b50b2f8427ea44f8a85fecf548f4f1ad40f46180f7bdd5121445f9ffabc553ae001444b0c557
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB