Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
14/02/2024, 14:56
General
-
Target
9bf81f95c8752c4ac5ade2301f15dae6.exe
-
Size
162KB
-
MD5
9bf81f95c8752c4ac5ade2301f15dae6
-
SHA1
3e915378385fcae1c7877bced38134afc27c8727
-
SHA256
1ee7faa2d2a66d52599844874ecc76240760d23bfbd3b7d0eceb7852b9d037f2
-
SHA512
de269a9734b5935bb9f6da3ca102e573747e09d0764f36c92e95159d4d7c30ac2f0da995e027c571cad570248c6938b875d78c71417c44c6248a0a57bed6a301
-
SSDEEP
3072:/mcvodpoUXUyCAw7GmUfuP5pxeQ8jUXvNK+T/b8bITU02MJ2:/mfHWAwCNo5pZ8MvNKGD8UU0RJ2
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bf81f95c8752c4ac5ade2301f15dae6.exe"C:\Users\Admin\AppData\Local\Temp\9bf81f95c8752c4ac5ade2301f15dae6.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9bf81f95c8752c4ac5ade2301f15dae6.exeC:\Users\Admin\AppData\Local\Temp\9bf81f95c8752c4ac5ade2301f15dae6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162KB
MD5e2967db6744476d47ea4bcb2350a9551
SHA14baef1a91d33ee27f89b7a11e7ee47cd2fd4506e
SHA256ddf95482c25c58bcc959484d80c293f2600b2ec043ed9697378bcc9972c11832
SHA51210bb69cb75f6101b73020c4b8f6d330f27c61cf4a124a7c62c01e6989dd124f32c731f10223df76282942a124e35c1a6378177fcec49e375440e2358442c4ac7
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
108KB
-
Filesize
108KB