Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 15:27

General

  • Target

    b509ad9e8d7627ae75793067dbb2276d.exe

  • Size

    1.2MB

  • MD5

    b509ad9e8d7627ae75793067dbb2276d

  • SHA1

    f9ac8a93ab6c5edfaf7323d74af7f53f339945b9

  • SHA256

    cd969c06cebb54db16326a886da3fccc63e17c52de1caa4e8ca5b85c2607e4f0

  • SHA512

    cd4b9210043264dfd917df42ff54d2b4d57fb7ec80d7b7547b6e80dd499b248f8380407cbfdebc6d9517ac0af7cb3526dc141f41fed3cc5227fe9fbddeb81c5f

  • SSDEEP

    24576:kuh90tqQCjdQ5+uav4NVajDpVUd4jSyImQCjdQ5+uav4NVa:kuh9oqQeC5+dsVa/pVVSmQeC5+dsVa

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b509ad9e8d7627ae75793067dbb2276d.exe
    "C:\Users\Admin\AppData\Local\Temp\b509ad9e8d7627ae75793067dbb2276d.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\b509ad9e8d7627ae75793067dbb2276d.exe
      C:\Users\Admin\AppData\Local\Temp\b509ad9e8d7627ae75793067dbb2276d.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:1064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b509ad9e8d7627ae75793067dbb2276d.exe

    Filesize

    448KB

    MD5

    bf15e251141b40ec3bf399220ccb2ff0

    SHA1

    1414c41d9a0a8551566679d7d3779ed1ad9a8e31

    SHA256

    9fb08a275d94515a1ab700e8079d23fb004f87e27a041eba441890f272fcb0d0

    SHA512

    7ada7294ed21174d2dde4ccafbc74153c2250344408d34e59d74c94033d2705f77e6f5aa9b8db46be84c8e9713007254085b410508c1aeaee8172b8095d24c21

  • memory/1064-14-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/1064-15-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/1064-16-0x00000000014E0000-0x0000000001511000-memory.dmp

    Filesize

    196KB

  • memory/1064-32-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/4388-0-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/4388-1-0x00000000014E0000-0x0000000001511000-memory.dmp

    Filesize

    196KB

  • memory/4388-2-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/4388-13-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB