Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28/01/2024, 08:18
General
-
Target
7c9e34e3197b734242ccc34882e55e6e.exe
-
Size
11.7MB
-
MD5
7c9e34e3197b734242ccc34882e55e6e
-
SHA1
dc4e6398f00006c2b7fda94d1d6f3ddb3640d381
-
SHA256
8001601351d5533bd0026c132c26faa92f68fd65a9b7964a923b13a9de9d7a40
-
SHA512
ee29aada892b9a44656fbc6a0472be974147a56b5b6a1e638b4fc2c139e5ba1c835540f27d505a9a03aed5990e12cc2d66e59d59b02aa265764565698e64f4ec
-
SSDEEP
196608:828T3grc5E3grc5JQl0HIpP3grc5E3grc5:8xgY58gY5Ja0HIpfgY58gY5
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c9e34e3197b734242ccc34882e55e6e.exe"C:\Users\Admin\AppData\Local\Temp\7c9e34e3197b734242ccc34882e55e6e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c9e34e3197b734242ccc34882e55e6e.exeC:\Users\Admin\AppData\Local\Temp\7c9e34e3197b734242ccc34882e55e6e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5bddfde689049d3a893bde3092d464446
SHA155f61107c982a99195884d3a4aa054f9600bcb3e
SHA2565a4d48256c7e1be21905aac7220a9d37b739b5fd9f6fe9eb6f72385fc5e52451
SHA512e79da0a06401c1c27f46b79fb6597e623ea872d6cba7143a7ae78a03524a516a9db9dd1fac25d57f2a74c2cbcfa6c22dcdb181632554a9c6900328552ac63d7f
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB