Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/02/2024, 18:03
General
-
Target
ac824d47a4d15778dd74790edb519291.exe
-
Size
1.3MB
-
MD5
ac824d47a4d15778dd74790edb519291
-
SHA1
a98d534d1b43b662fd2abda00c4e7583ffebb1df
-
SHA256
a8a17a5065108c7d04210fd5b6848983d38a4380e9a9da1216d5c53d2bff45fc
-
SHA512
37061d5e9a4c6e206c55fbac981cacde238e68249db56edc7d0378bb56f99a4b3c63ff7eab697ff5be6238b7a2f74156dc91fafb1e4de856317b311c583d48c7
-
SSDEEP
24576:TTTV6bRa7ACGDHpepiMLGN4o0nMyB/lTUEPIW2KujNFjRekvG:TTTwRq4WPuQMyBmaEKujXj
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac824d47a4d15778dd74790edb519291.exe"C:\Users\Admin\AppData\Local\Temp\ac824d47a4d15778dd74790edb519291.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ac824d47a4d15778dd74790edb519291.exeC:\Users\Admin\AppData\Local\Temp\ac824d47a4d15778dd74790edb519291.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5b20fd187dd6f1e5f7ed2b1c9ad256d2d
SHA143ee56ffcfd5e6d64309925ab01ce9274abb294a
SHA2561afe74e45a37e380f6e0a707fa1eac91ef265157a3612e2f5ed8145c4ade7d1f
SHA5125b79bcd7a935946347ba0185a2d71417909828dc43f9d189281d4d994dfec494aa32f6072da7afae4d811055ac0ea0d6771fe63f3f4290d21a11b368e62d82b9
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
1.9MB
-
Filesize
1.9MB