Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    155s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2024, 01:44

General

  • Target

    859a1c3e01975b7a6edbb727fab7a59a.exe

  • Size

    302KB

  • MD5

    859a1c3e01975b7a6edbb727fab7a59a

  • SHA1

    9b091bfbb604e274c22ccf8c2d938eb564df2c0f

  • SHA256

    b31e4673799ded3a147eeaae023fc500b23cce612b95fd1902c7db9579f01ca7

  • SHA512

    dc8ab5dc8493b6d5d3a3a2e153ea23809bbac53b852122a08d9c98fa7ad8486685a6ad0eb5ff51f499ded8a61e05bb38cb1ea8a250bac4961c7f778a4326610b

  • SSDEEP

    6144:ri4Q9x0sXx9aAnw+/Off1XW1zNRSGNHmQ:adx1nwOOff0fRSGVm

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\859a1c3e01975b7a6edbb727fab7a59a.exe
    "C:\Users\Admin\AppData\Local\Temp\859a1c3e01975b7a6edbb727fab7a59a.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4968
    • C:\Users\Admin\AppData\Local\Temp\859a1c3e01975b7a6edbb727fab7a59a.exe
      C:\Users\Admin\AppData\Local\Temp\859a1c3e01975b7a6edbb727fab7a59a.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4280

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\859a1c3e01975b7a6edbb727fab7a59a.exe

    Filesize

    302KB

    MD5

    afee691ca51f51b6a58018dfae69425e

    SHA1

    f85faad9fca9bdec167afd122ebeac5feeeb8186

    SHA256

    913dc7d6c9cf11f6a7f8f22aabe9438efa414b0e7dabdaa1c18da1e921b02a8e

    SHA512

    81bd665edfa4923519fcae0ab20bce744cbf40ce125336cc3b315c01db52b328c76484a3ada6c1c670a3d6e591754e48591f556e3b438c5c647cd4d79d387746

  • memory/4280-14-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/4280-15-0x00000000014E0000-0x0000000001511000-memory.dmp

    Filesize

    196KB

  • memory/4280-16-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/4280-30-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/4968-0-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/4968-1-0x00000000014E0000-0x0000000001511000-memory.dmp

    Filesize

    196KB

  • memory/4968-2-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/4968-13-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB