Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 11:18

General

  • Target

    9949d275e7ac8c5a0bebc47d28f8aa45.exe

  • Size

    5.1MB

  • MD5

    9949d275e7ac8c5a0bebc47d28f8aa45

  • SHA1

    337131470ec47f55cfc616cd9b77fcb6e35644f4

  • SHA256

    6384a78a076ea0fd43684d132903845426ebb2600ccde5d8555d514f976a3c74

  • SHA512

    c1aa8c1b4d62ab45bf605eedf7aa92dadf406561351a2b39f946bedc162cd86076a2d320753aab5ad5f6505e3baa933813b49edf06ccdbd7c5b8a9feb3338a4e

  • SSDEEP

    98304:x4P3UWmGd3Il4Iadp35zgMi3bW+Ab+6+nwK3:xA3UAiXQzgMv+k6

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9949d275e7ac8c5a0bebc47d28f8aa45.exe
    "C:\Users\Admin\AppData\Local\Temp\9949d275e7ac8c5a0bebc47d28f8aa45.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3252
    • C:\Users\Admin\AppData\Local\Temp\9949d275e7ac8c5a0bebc47d28f8aa45.exe
      C:\Users\Admin\AppData\Local\Temp\9949d275e7ac8c5a0bebc47d28f8aa45.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:1664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9949d275e7ac8c5a0bebc47d28f8aa45.exe

    Filesize

    2.6MB

    MD5

    d2ab4ec0ec9b9ac37a3ac13682b9aba0

    SHA1

    39f5c74fab8b9c3144c7369fc0d24e02f2211652

    SHA256

    58efe38cf40cd2405996b0084c4f289d77721d3d6a658ec1883846733611f761

    SHA512

    26edf6b45c11783f1b23c86e1bdaf5e2b0f63408a10cebff84a0b4067c53504c70104d096efb3e23aab89b05a6b110fd3f4aef2c49e2e95465d455e8554742a3

  • memory/1664-14-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/1664-15-0x0000000002150000-0x00000000023AA000-memory.dmp

    Filesize

    2.4MB

  • memory/1664-31-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/3252-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/3252-1-0x00000000021C0000-0x000000000241A000-memory.dmp

    Filesize

    2.4MB

  • memory/3252-2-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/3252-13-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB