Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 10:30
General
-
Target
8eeb93003da4d9c8685c8d78190175b7.exe
-
Size
5.3MB
-
MD5
8eeb93003da4d9c8685c8d78190175b7
-
SHA1
66f8c1127a34519b1af407719b544b48ee0d91ce
-
SHA256
92983319a078d081ce4ed74fda7b7e3a561e28fc7d85b1bf09f9480341b2769a
-
SHA512
eba1bf8e8b5a001f8849b2b63411d11a5c19fed5cfd8f810678cc738b3020d3d04b5bdfa402fbc28316c0c2fae53c8c92513e29738fdea2d560e0dcf71db7e17
-
SSDEEP
98304:B7Uf3WyViQ1B6Fqhv7sO61564ekFzekTnI71B6Fqhv7sO61564ek:U3d0Q1B2gvkaAF9TnO1B2gvkaA
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe"C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exeC:\Users\Admin\AppData\Local\Temp\8eeb93003da4d9c8685c8d78190175b7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD508eac32c95775b154805efc9389c70a9
SHA19e43723ad9231b7440a708bbce6a5be310861310
SHA256eae187049bae1492db2983e40bf69ad9f59cb06823367f7474b625b263e0295a
SHA512e19f763ff188d049b191c129d36ea09769785553ddcabb5c16fa6e3f41ce0f3b906665650d68a90143aae4ce990e7d22250fd3e51da4b8f52b5a541e9f08a837
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB