Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
13/03/2024, 14:31
General
-
Target
c61d23cdfcb1361604e5cf7a8917fa2f.exe
-
Size
4.8MB
-
MD5
c61d23cdfcb1361604e5cf7a8917fa2f
-
SHA1
a737e6f4e1dca4708c988f8788bd29f8142f44bb
-
SHA256
c3b5677bcc4eca780769484da27129c6c700f58ec451037b48459c1997db843b
-
SHA512
d6dac9a2f45b55b72fea84db1fb92c4569ac1c5b6c30583fd59d60a8e66198e64dd2514cc0aed9673cd97f2c4fcc6721bb0c4de7954a2e43c152fa61708e68fc
-
SSDEEP
98304:chIFZZbRdgg3gnl/IVUs1jeCB1HuUuN1EJgg3gnl/IVUs1jr:cugl/iBBB1hm1Wgl/iBP
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c61d23cdfcb1361604e5cf7a8917fa2f.exe"C:\Users\Admin\AppData\Local\Temp\c61d23cdfcb1361604e5cf7a8917fa2f.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c61d23cdfcb1361604e5cf7a8917fa2f.exeC:\Users\Admin\AppData\Local\Temp\c61d23cdfcb1361604e5cf7a8917fa2f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.8MB
MD577a492c1cc76d48724379338dbbafaa3
SHA16edd3df172de91276fd103a3c382c549a55927e1
SHA256b4a79424f66baf2b697b44e9f77c94f4c862545acfedcc80e116c0fa0a1c38f2
SHA5128c809cac99d91d2be719e0d8a4df6fac81c9e5168c783c0748a9206b195d7f350293437430acc775f240b704b55db0e391b399deb3824974d270af2a262843c6
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB