Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13/03/2024, 06:18
General
-
Target
c52eb62ee59056c8f60b64460a0b6dea.exe
-
Size
82KB
-
MD5
c52eb62ee59056c8f60b64460a0b6dea
-
SHA1
35401464e5f8e2599380203bf30d2b8cbc1ec469
-
SHA256
396d4a00137faadcd673fd5fac094e923b7effc9f177e20d4f93bbf36c9088c2
-
SHA512
dd2e0ed06322f5eb9a40bdc900b18d154e01aacec153ae4533b3c882116b3622668983ab10cb947e519a526755fb4f3a540ece2ab5579fc6eba965a6b103cc8f
-
SSDEEP
1536:jkEYi2wgg5EvgYNSda0tSYchyDIPhTFd3ZymUlDOGYvB63FlhjaH:vYi2y5AR0tSYxziVvB6Vnjg
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c52eb62ee59056c8f60b64460a0b6dea.exe"C:\Users\Admin\AppData\Local\Temp\c52eb62ee59056c8f60b64460a0b6dea.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c52eb62ee59056c8f60b64460a0b6dea.exeC:\Users\Admin\AppData\Local\Temp\c52eb62ee59056c8f60b64460a0b6dea.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5f53d4e6a2e85d476bbb1a459234c7301
SHA16e95f2c9bfaf4e199da28582f13d2e1ee3ec0139
SHA256d74fb06daf987fd65d5f499a56a1c1abcf005d607beaf8b7317f9c5145a5c428
SHA5122e4abd6a3b4d1c1aeec60bf1708202fca653fa34ee6c554973ec8a11b3c9c47f3a27c50522635742197958eec528e8f5356046aea862fbd97cb2acfce4e31ed1
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
108KB