Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
07/03/2024, 17:19
General
-
Target
b93e5a2e8779157d93c4e483cf5f1e06.exe
-
Size
1.6MB
-
MD5
b93e5a2e8779157d93c4e483cf5f1e06
-
SHA1
ad8fa9f7587d4eafc5cc716e773cb30551d133f3
-
SHA256
a391273e1302246196bce1ce205197a6d936493f31373083b9beacbf6a047cd2
-
SHA512
3c08e5b22259ccd85a5b74588f053ff44ae4b3e463162bf4d353aaeff6c4104e334137a2a9609ff9328c1cdd5bd95742e1d0a06f74e34a0fec6a3948243e68cf
-
SSDEEP
49152:kIyBGeeMY8bpzu43eNJHolNmJhOJuc226tMc:7yYjMFbpzre7D08c22O
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b93e5a2e8779157d93c4e483cf5f1e06.exe"C:\Users\Admin\AppData\Local\Temp\b93e5a2e8779157d93c4e483cf5f1e06.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b93e5a2e8779157d93c4e483cf5f1e06.exeC:\Users\Admin\AppData\Local\Temp\b93e5a2e8779157d93c4e483cf5f1e06.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5fd9ea711372f5a060f4252be7e7c652f
SHA1d3a0e297d87123aaaeac5467994182eabe7b2e20
SHA25680b4c579c925da1f7a97ea4e869524d7e0bb10c01bf9b0a883654b3edf42ff6b
SHA512150d77332e2d6ac3737656cff7244ef4d0337f4626eccd014a47a4d0eccf8afce7055b6a753a3459cbdecc723e9fc8ffedbd3415d33b035070f41ff6b8ac0f94
-
Filesize
4.5MB
-
Filesize
2.3MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
2.3MB
-
Filesize
4.5MB
-
Filesize
2.3MB
-
Filesize
4.5MB
-
Filesize
2.3MB
-
Filesize
2.2MB