Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/02/2024, 00:15
General
-
Target
97fc8763592eb7f6fb56f15f6bd02362.exe
-
Size
385KB
-
MD5
97fc8763592eb7f6fb56f15f6bd02362
-
SHA1
247970134c27a6259be6c7603a869b91eb5f4f4c
-
SHA256
fb2466c612cd158cda2a3345354d746df248bfdd6db3a905527b838e39051f92
-
SHA512
96a0a53ce3e175e9b32e8930dbe72defc26c3bf9112c4fc1cde7000f82e096631a88c8e721c6e3c8db0344aab3545e5030159ba4b309076c23b1ce8bda61d5eb
-
SSDEEP
12288:fQXNPo6gyFc++y3KEQYa90CwtURRwMMJVmB:oXNQ1yl+y6EQ3+CTRkwB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe"C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exeC:\Users\Admin\AppData\Local\Temp\97fc8763592eb7f6fb56f15f6bd02362.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD5d535f16821be9b35ba9c6fc91ae42edf
SHA154db593750ea5eb5091e1a945ee1c7569f84d2d8
SHA25610863ab4c27583d9b104c7aebce8b7fb5020148fee6dcefc48ab2a4cd6b2fade
SHA5125bd3d7ca66e6370cac04bebffa9b551d639b4f60d298625a680e3c5bc168109dd63e326f43c03d0366c4ac2df7b1369496f1d9750431f5099d78a33d33ce094f
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
380KB