Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
18/03/2024, 20:06
General
-
Target
d4675b6afd2e4bf317d840d3e597e21c.exe
-
Size
1.8MB
-
MD5
d4675b6afd2e4bf317d840d3e597e21c
-
SHA1
0e9143cf72bf8a6386416adfec5c694756db5602
-
SHA256
b05304400a396995a0a1071639da8aa2edeae273b2baaf0d5562e26e121c5053
-
SHA512
fbbf44249b98460c037aef5c4ce87ef2803f406061ed729c5f0187b42346e39a885826990fe30cbb4a4007f7732e8204f9143c78804f4371fc22479d6c40f8a0
-
SSDEEP
49152:b10WjYmQOuKtsS0i1YscooE4iqJyLZVkVbhOwP:p0SQZKtsS0i1Yd4othOm
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4675b6afd2e4bf317d840d3e597e21c.exe"C:\Users\Admin\AppData\Local\Temp\d4675b6afd2e4bf317d840d3e597e21c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d4675b6afd2e4bf317d840d3e597e21c.exeC:\Users\Admin\AppData\Local\Temp\d4675b6afd2e4bf317d840d3e597e21c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD50450e28a005896a8d54d345e285704ce
SHA125896b01f6301038bb65a074fb93bde8e0613b44
SHA256be1cd7ff80ce914c722aaecbd301d1399b4e32f65d8d6de73f65fd16a6981266
SHA5123d51a8339fedcc5e4588567eb5b94c81cead82358219aa83ae5b375c7cb9f2359c4e61b3a3cba6c75dbf7e060d407190902b134a559076f8ad319f6db381bad5
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.1MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB