Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

7

c3c49ba1f0...1d.exe

windows7-x64

8

c3c49ba1f0...1d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 16:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c3c49ba1f06fca8a8b0b43c09f02711d.exe

  • Size

    9KB

  • MD5

    c3c49ba1f06fca8a8b0b43c09f02711d

  • SHA1

    9edc8837f7d70828f39744408f9f3158853b0333

  • SHA256

    32c2b7bbc4c7aa1e4c3c4512512bc5e0995c27884f1e484f57a9a9299c8d6dc9

  • SHA512

    2667ff0c67ae09193cad370aa7134e417b150d9347e9a4895fa1151be00d7518a7cae67d616333fe6716c809bdb43b9a17f3de747be5dd46dabc974ecce9694a

  • SSDEEP

    96:r2Q9dAIgfheyX7NY27MqHn2WfnamnQ4LIB/sWn/KPJAmwhhlkqRnKsmMf9ka:JXAFJdq2/faNns0/KPSr+qknCJ

Score
8/10
persistenceupx

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx

Processes

  • C:\Users\Admin\AppData\Local\Temp\c3c49ba1f06fca8a8b0b43c09f02711d.exe
    "C:\Users\Admin\AppData\Local\Temp\c3c49ba1f06fca8a8b0b43c09f02711d.exe"
    1⤵
    • Adds policy Run key to start application
    PID:4748
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2336

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4748-0-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4748-1-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

      Download