Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 04:53
General
-
Target
bfe4f0d29282ed16c45511d97d980608.exe
-
Size
3.9MB
-
MD5
bfe4f0d29282ed16c45511d97d980608
-
SHA1
fe20bce50164f5364ca5ace1ffe7058901782058
-
SHA256
9644df7248fdad47baf5756f565acb9b8a1a241804bc8a588cbbd9410c591c99
-
SHA512
c5ae7840bb4a87541c8e81029575b0e0a42e12715ece01631a3d2a6b8823173543a08a677b359703393860a0c7b30c391644fad829346382a88af01135fcee1e
-
SSDEEP
98304:GfoHvnhPo65QHpgg3gnl/IVUt4pJWzZtIygg3gnl/IVUV:F/q6qPgl/iwgWttJgl/iG
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe"C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exeC:\Users\Admin\AppData\Local\Temp\bfe4f0d29282ed16c45511d97d980608.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5b5fd43da52efcb575f6f0367ae35e25d
SHA14a634a001647fb07f79a3aa6e4ecb48672ade674
SHA2569728a9d06493235c7cd44bef1eb483e1d8cda51e9068706982ccd3dab8c19cac
SHA512c3caf8749733086202b3beedc1febfd856204157b233bbc01a070d116589804201b03da0f363481c05c58a2558455121219db38562f1567501fe64eb0b3dd52d
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB