Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
25/03/2024, 12:12
General
-
Target
ddfb773c777f833dd62af65374f485b3.exe
-
Size
2.7MB
-
MD5
ddfb773c777f833dd62af65374f485b3
-
SHA1
c90a7f4faed536336d40066b5580e2207d030925
-
SHA256
e72112189432a6236c35351d221864675d6c11489cf1ee4ac7efbc38de906245
-
SHA512
e03660100d113f8fd4044bb0f2133f380da1803a367ff5107d9e5c9c5b385cd5eb5bcde5d73c1a3a67341e2529f74cd35acbc4642c6189cc260bbe3ab47a3499
-
SSDEEP
49152:wjcVdONFKPIlaGPiltTvICsO7XygRhZ1Bonf:wjceKRGPpqbyMhZ4f
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exe"C:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exeC:\Users\Admin\AppData\Local\Temp\ddfb773c777f833dd62af65374f485b3.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD562249aa84c685b8b1aaf32c78ab6adb8
SHA173dbbe8f71ec83f1a611b0ccaece8b2a5bb0629c
SHA256713e9d531a2659f595fa8f96a2cfef19d9664af3b0c748192b54767b64a7cfd2
SHA512dd2c2a16685ce1d333b86b20d798088f32f5fb9ad5f2b7d463269bdced6862b83edf940d8b55b1c35f618a828ec156d848f5f524ac856012c3c679049d1988a3
-
Filesize
1.9MB
-
Filesize
4.4MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
1.9MB
-
Filesize
1.1MB
-
Filesize
4.4MB
-
Filesize
1.9MB