Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/02/2024, 21:59
General
-
Target
87c4423ac0440e9a5938f82cae77f0e2.exe
-
Size
1.5MB
-
MD5
87c4423ac0440e9a5938f82cae77f0e2
-
SHA1
46b858266b5e875af8c8b4260bf4c07c7fc69214
-
SHA256
6ce77f13690f978de4e12fa5e936f06bb0b5f41ee93490a7d667ab49be432b46
-
SHA512
8279bd3fd5b36542e54fe4846b2b4424eca536276082eedc678ffd649b8e998bf723df171991118392e554ecd6b54532d3adef18ee95fa31007c996ce03fbfbc
-
SSDEEP
24576:Ti1qQH70z9Rrvsf3UFG9SJwkXHwXKBKfAL2i5B2bLtaLL+W:TM70zbsPUYMw2wA8ALVPeL8La
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87c4423ac0440e9a5938f82cae77f0e2.exe"C:\Users\Admin\AppData\Local\Temp\87c4423ac0440e9a5938f82cae77f0e2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\87c4423ac0440e9a5938f82cae77f0e2.exeC:\Users\Admin\AppData\Local\Temp\87c4423ac0440e9a5938f82cae77f0e2.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5a7051a1111b62a982fd5f619c208166e
SHA19ef65fe91af0cf15f85debbca86d5b9804acb2e3
SHA256bf3cd01c13abc035afc8f0af89eb7d3a3458cf78f2a3cc3003d462a5c511e860
SHA512975ee3de951041064509395c6113ec0f8aefc6ecf6e0dcef4021124c683d4d5c7601d9a88ccfb95923cbf8d15643cb5b2d85789c27d617b98c60459793a45364
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB