Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
15/03/2024, 06:34
General
-
Target
cab8eebf044b1985bdbde318a854b7bd.exe
-
Size
1.8MB
-
MD5
cab8eebf044b1985bdbde318a854b7bd
-
SHA1
04ac6f94e031ea84ecdc8c6fda35259f81ca342c
-
SHA256
4f823370e872c90a7aad7d1e434c33ed8c149f908710130ed05544c868a13c1a
-
SHA512
f91fc67db25f274ba8d4a4203017729561a87b0c71a03ed5f4fe4722d22b0f725e3455b5adead1d0cf7794d3831241b79c8fe3d5e2ec274cd537a83af06a8719
-
SSDEEP
49152:Hwj425vOYx6ffj425vOJb1j425vOYx6ffj425vOH:H4nEYx6jnEJbFnEYx6jnEH
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cab8eebf044b1985bdbde318a854b7bd.exe"C:\Users\Admin\AppData\Local\Temp\cab8eebf044b1985bdbde318a854b7bd.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cab8eebf044b1985bdbde318a854b7bd.exeC:\Users\Admin\AppData\Local\Temp\cab8eebf044b1985bdbde318a854b7bd.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD56a5899b7729f23bb272b2e8ab2f179e3
SHA162b8bdc98e5f7908adf548572fb5311236abea8e
SHA2563262d4cfa6c397965ff45becea4c5742c66fccdc4c3574882dd5db0a5e318915
SHA5129df824a4bfb57deaea177fe6bb6da347d6ec46d1e5ec28413205c75f5692620b86b0542585aafd080034178c86422a856f77bb47a2784dddd17680c130af4ff0
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
84KB
-
Filesize
212KB