Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 08:52
General
-
Target
9b3ef43d18a8c0d2959c8ce723e3a263.exe
-
Size
2.5MB
-
MD5
9b3ef43d18a8c0d2959c8ce723e3a263
-
SHA1
950dc315adae5660ffe5a2a2b7e2e8f4cffa9d18
-
SHA256
94ffc3b6ce6fe7d046092cd35a9259d94874e8cbd74c5fef5109a2c8999cc4fb
-
SHA512
e988e1d2a19298a080162593c350aa27cbaef92e4d49a8b75ede1700d3b03438fa237759b67cabaf7160eed9d59fb0c8386a9619388cf3a741ecc32e709b66a2
-
SSDEEP
49152:kLmM/TWIB3OALfZnCNAtN74NH5HUyNRcUsCVOzet0:QpWIB3OAjZnCNU4HBUCczz9
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b3ef43d18a8c0d2959c8ce723e3a263.exe"C:\Users\Admin\AppData\Local\Temp\9b3ef43d18a8c0d2959c8ce723e3a263.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b3ef43d18a8c0d2959c8ce723e3a263.exeC:\Users\Admin\AppData\Local\Temp\9b3ef43d18a8c0d2959c8ce723e3a263.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
640KB
MD5ca75f09efc7c42528fa8b7a00878f192
SHA1a8066c6576a103ded5589fa1d925988b16692543
SHA25618ca288c4a5fa568d25b6d52817e3f3a2d6f01c5964803ed5669753b3d039306
SHA512f8a5844ec42302191aeccc7b768963e3cff12c49bb39abbbcf1a49f296df1d21153033f280ceea7a48eaf1ace6f3ce163fcefda8390cc0b19110d281fa01507b
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB