Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
19/03/2024, 03:04
General
-
Target
d50c6aad7ff9b2fb4bee19481147710d.exe
-
Size
82KB
-
MD5
d50c6aad7ff9b2fb4bee19481147710d
-
SHA1
323f034ae848f41115574d7469761e8cb6a106c8
-
SHA256
60cba2f56dc8b161d94949f67d466d283ab7014397c275bd6d5dc23b79115811
-
SHA512
88f262d4920d232bbe651f38081babb7fb8fca23e31dabc7ec0ba79d0f996b0b61af038dd0ebec3ad9aff252e4bc6b015295e9e8ae206e682db65dabb41678f4
-
SSDEEP
1536:q6pz9ZO9xLtxN6VCIzsW8bOIlFBWeaWlifbM:q+q91tj6fzsVrBVBko
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d50c6aad7ff9b2fb4bee19481147710d.exe"C:\Users\Admin\AppData\Local\Temp\d50c6aad7ff9b2fb4bee19481147710d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d50c6aad7ff9b2fb4bee19481147710d.exeC:\Users\Admin\AppData\Local\Temp\d50c6aad7ff9b2fb4bee19481147710d.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5dc728ddea0de01cfeccd40566d056e9f
SHA1011329220abb455296dae38725d1ee60f0439f37
SHA256895f21b42852fd2f750461b0f68da495e3aa3c2b42cd00dd99d25de56726bb69
SHA51287a695a0c8ff7491f8a421b67a074e6ea08a1d37201fa488d7f41554f62b53c05af50dd59bec7c5d9245a1c8ad4dbfda2194fed238c6875e29d2e29274ba9620
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB