Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15/03/2024, 13:29
General
-
Target
cb880b20e82e9344e087e9a8928a3404.exe
-
Size
385KB
-
MD5
cb880b20e82e9344e087e9a8928a3404
-
SHA1
5f488cf8bd562d6ddca463dffcd351a215f56d79
-
SHA256
2d5b6512c980202c3fb4a494083f45b081f0d6ee308d3ab51a1a0a144db88979
-
SHA512
cd052a4b881ea43026f747d6a7dd20546a4956f5a6e8e4d9c32eee81bfaf09bbfbad26f075a81d32b14cad9426c1f750f05ed4914f7023de62c0a8af4fa9afb6
-
SSDEEP
6144:m42IYC1BgX7dpx8tJT328j4uw16KHsYxryAm2ZMbm/B:ENC/gHx8tt3bjc7v+sB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb880b20e82e9344e087e9a8928a3404.exe"C:\Users\Admin\AppData\Local\Temp\cb880b20e82e9344e087e9a8928a3404.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb880b20e82e9344e087e9a8928a3404.exeC:\Users\Admin\AppData\Local\Temp\cb880b20e82e9344e087e9a8928a3404.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385KB
MD50e1d9687308f537339957338a04e0514
SHA119c310d7d771235cf0828bc9c9b4553506aab140
SHA2563fd55007a38221031efff85358c9be0ed25026067170689ead0b64a97382987e
SHA5122a953a90a78af7a8291b160c125a39906c1feae433e6128f7dfabb1b5baffe5040d66084cb952ba481ece59fe206ac7b0edf223fb05c5ae8e760dbee7abab1df
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
408KB
-
Filesize
380KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
240KB
-
Filesize
380KB
-
Filesize
56KB
-
Filesize
240KB
-
Filesize
56KB