Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    82s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 03:21

General

  • Target

    8b436697546c55affeca4d296a94d865.exe

  • Size

    133KB

  • MD5

    8b436697546c55affeca4d296a94d865

  • SHA1

    f17670507c187d9ec295d8e1a7ded1fde37344c8

  • SHA256

    40a4a40ce20b2cc166f429b0a16dac5757e15952a2580f14034a11448251040b

  • SHA512

    64e286aef800e551ead85230659b44bd34a5b0aa79cdcd6573d594ee25238a874c16f1bca53c96f6439dd0326cc66b430d62c57a44f7176f1f7d8e2e267a6b14

  • SSDEEP

    3072:l6Byi2HgHcQ6GG4fxMxoOFXZHzGKg7AjQSZdKzWZoQ:l6By1gHcJ0ooKX1GKgMjQSZdKzEoQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe
    "C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe
      C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:4360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8b436697546c55affeca4d296a94d865.exe

    Filesize

    133KB

    MD5

    e13c70595c4c2ddd146f187ea01f797c

    SHA1

    2e1c37b8050899e03d5908883bea1153dada11b9

    SHA256

    e5521be9bd2d60b75aede1d98f0bdba156b94ae18ad1a088161950d66b140063

    SHA512

    2472a5960b0f8240d95da8955a88aa496a78f5cbda7142e44086e07e0b0eabf89f913667367c4861b09d0d45366cba4cc8e705653225432d592feac4f9e5b3c9

  • memory/4360-14-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4360-16-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4360-15-0x00000000001A0000-0x00000000001C1000-memory.dmp

    Filesize

    132KB

  • memory/4360-30-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4900-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/4900-1-0x00000000000F0000-0x0000000000111000-memory.dmp

    Filesize

    132KB

  • memory/4900-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/4900-13-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB