Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 16:34

General

  • Target

    999f3765cd39a7bb92de3ea9a064e100.exe

  • Size

    1.5MB

  • MD5

    999f3765cd39a7bb92de3ea9a064e100

  • SHA1

    f0e77b6c9b1ed2c1fa5ba5038e14d057043739cd

  • SHA256

    6c1077a782c95c8dcb0cd83d2e9a45325e693df635000f7f8129d2c3c6fe32dd

  • SHA512

    1f41e9363efd66a84ce33a85d5e07a6266f56ec8ff4ffb03b6ae17b2cfbc3c08667d7553faade2df7def79480e9077092782ad884686ef344ab1e7dddeff1b03

  • SSDEEP

    24576:wAko7AUDjtrJnFlvOZYc41WGBBoFTuu80bOSywIL6+qF+YtW:wAko7tVNFlBo6WF9j6SNH+A

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe
    "C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe
      C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:3276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\999f3765cd39a7bb92de3ea9a064e100.exe

    Filesize

    1.5MB

    MD5

    760a7ee497423c43b01e1d2228d63a88

    SHA1

    0561f7d10a10c3410dccf53bcce93c59e5865e43

    SHA256

    60421a97d0bcff7f8865739e3a9850da1f1a7e165e9d7a1a643994290b35d987

    SHA512

    b198ac6eb223a0853d7ffcd20f224174aa5488a00dcd856b01b7215bf80ecc7083de40a8b885c2b2d14db5dec34c55b8902d45c044a2934bd13c3dd24efd4d4e

  • memory/3276-12-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/3276-14-0x0000000001CF0000-0x0000000001E23000-memory.dmp

    Filesize

    1.2MB

  • memory/3276-13-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/3276-20-0x00000000055F0000-0x000000000581A000-memory.dmp

    Filesize

    2.2MB

  • memory/3276-19-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

  • memory/3276-28-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/4040-0-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB

  • memory/4040-1-0x0000000001DC0000-0x0000000001EF3000-memory.dmp

    Filesize

    1.2MB

  • memory/4040-2-0x0000000000400000-0x000000000062A000-memory.dmp

    Filesize

    2.2MB

  • memory/4040-27-0x0000000000400000-0x00000000008EF000-memory.dmp

    Filesize

    4.9MB