Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

9c0a91778d...4b.exe

windows7-x64

7

9c0a91778d...4b.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 15:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9c0a91778d0ea0cdf4e950327551364b.exe

  • Size

    405KB

  • MD5

    9c0a91778d0ea0cdf4e950327551364b

  • SHA1

    deadac0aab81603422eded52ed12b146250781a6

  • SHA256

    e4930c125a70e8e968fc364b1a66022be47f14408800e838b7d80fbbc2574834

  • SHA512

    28543823bcb4346fb5d03c29c8f703530cad9488308c954983c9d91ab526885c08f91a2ecbded275cccc80f69a85d591f4a7be5e5937e9fee4947bfb93d33ba6

  • SSDEEP

    6144:1UCKJ1qLbGqnP8nI0jSCdW81XJPHu3d0o7VmfcPTwQRW9GMfni1fOkD:1sI1P8TjSCdllJfu3d0ITwCgZf8

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c0a91778d0ea0cdf4e950327551364b.exe
    "C:\Users\Admin\AppData\Local\Temp\9c0a91778d0ea0cdf4e950327551364b.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\ProgramData\pGaLlFc08504\pGaLlFc08504.exe
      "C:\ProgramData\pGaLlFc08504\pGaLlFc08504.exe" "C:\Users\Admin\AppData\Local\Temp\9c0a91778d0ea0cdf4e950327551364b.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\pGaLlFc08504\pGaLlFc08504.exe
    Filesize

    405KB

    MD5

    3a377ec3a559297e13d2be5b32ee8fa7

    SHA1

    efd725d8dab08871dee56d3cf5a2d051033fbef6

    SHA256

    44da2583417dac2a780e0111e8765d57b4ac7f0b579c38947b0330a49057edc9

    SHA512

    083dc4da52347b5bb8a445432d3833f491dd0e5b99fc21c5cd7c7cadd8225d548d51f337e9ab46b03d570fff8f271605b386317d3aa950d30c8d0db1cb5cacf9

    Download Submit

  • memory/1332-1-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1332-2-0x0000000000670000-0x0000000000770000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1332-16-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1332-24-0x0000000000670000-0x0000000000770000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1332-29-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1664-12-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1664-13-0x0000000000810000-0x0000000000910000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1664-17-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1664-23-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/1664-25-0x0000000000810000-0x0000000000910000-memory.dmp

    Filesize

    1024KB

    Download