Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/01/2024, 08:15
General
-
Target
79baef261f0444657e0f52e19bdb50e3.exe
-
Size
2.9MB
-
MD5
79baef261f0444657e0f52e19bdb50e3
-
SHA1
49ba5cf5f9ee50f44cff5026dd3c0ee60fe17923
-
SHA256
b169342b97a3aa28478eaddec3f745e04739b8401f24f444a6846bbe5e5d01ec
-
SHA512
6ea8fce52183b7ef0b01819618501ed59b728a457f23dbd447a47a650d0fe9a049ba1371fc4eba403158b5ab43df71a47649839f5d5e61c014b99ae6d4eb5095
-
SSDEEP
49152:j1c1Fvf/edwgp0wMLP4M338dB2IBlGuuDVUsdxxjeQZwxPYRKs:uHWdLpggg3gnl/IVUs1jePs
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79baef261f0444657e0f52e19bdb50e3.exe"C:\Users\Admin\AppData\Local\Temp\79baef261f0444657e0f52e19bdb50e3.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\79baef261f0444657e0f52e19bdb50e3.exeC:\Users\Admin\AppData\Local\Temp\79baef261f0444657e0f52e19bdb50e3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
413KB
MD563a9bcb11312fe5f5612edfeafb4a786
SHA1934e110b55be4bf52733ab5db80558c3357d1786
SHA25693f30aafbb52a6ccf18aaa740d0cd8d17ebeeeb6782d23455f3f057c82e26887
SHA512b109f7d14e5a351851950b3f23ac63cc4f5fcc8d268876a5e1df68cf7632f5eadd51cdc21ed5409e7cf0c41b670ffe6ab3128ca81c14791c7e7308459f1b88c4
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB