Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
13/02/2024, 01:44
General
-
Target
982a2a37014fedf4f8fa818a0600415e.exe
-
Size
907KB
-
MD5
982a2a37014fedf4f8fa818a0600415e
-
SHA1
05a71c39ba557444ff99fe7f2b739355a0400bc8
-
SHA256
e2b042db729503f4460effc1bbef1eaf30b02ab70840bc847276d0dd19f464ba
-
SHA512
a5271c7ff29d005c4cabe8d9e088cbdd9012c7bf55d4f904eaf60918cc9ca2e5bd85795119fc6f0f20ec9def8a17e2e354fb92810cb0a8c382eb9fb73cc24321
-
SSDEEP
24576:bMJnIv4Hew/yxwh9XOMEVYyO4qJ2ln/Ka/ZS1:EnIAHd/oI91EVYyO4FCgS
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\982a2a37014fedf4f8fa818a0600415e.exe"C:\Users\Admin\AppData\Local\Temp\982a2a37014fedf4f8fa818a0600415e.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\982a2a37014fedf4f8fa818a0600415e.exeC:\Users\Admin\AppData\Local\Temp\982a2a37014fedf4f8fa818a0600415e.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
907KB
MD5cb315b28643d427ff39363ff50a6812a
SHA191d089522b4165d8b1e13353bea06ccc526b9c10
SHA25613266bfda0d3e427e9718e8684e99bb75f00ce3d899b75ab263cac648183c519
SHA512ab37fee13dccb27219b145d08425a216788fb0f826e32a211fe3acfb976819dd6bad106eb2a6ea2b59ae31d9507c4ebee04ce4a84e4392596bed984752bab3cc
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
748KB
-
Filesize
748KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
608KB
-
Filesize
748KB
-
Filesize
268KB
-
Filesize
608KB