Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/03/2024, 08:40
General
-
Target
debe4ceb4a7130aa9167feb43bbccf64.exe
-
Size
1.5MB
-
MD5
debe4ceb4a7130aa9167feb43bbccf64
-
SHA1
60747ac999d5da3096d3216e72727922acf22231
-
SHA256
6aefff1c302345da2d7f5f3968362c6c81d9d0b5488f96b884fbf91819b13359
-
SHA512
69f869519f5d3da10800b6a35e7d03ef9f3505760a20e0a57a71964e8f27d0a88ca1f3b254274ad13563eee6db83e8b847b98e606d5536b8d3094ec129ec172d
-
SSDEEP
24576:ZuOD2kj5kczo5nW8QynR1QVr1wiYE6TOfQS1WNncIDpzW:VjC9dyyTBiYE6Te1ic2
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\debe4ceb4a7130aa9167feb43bbccf64.exe"C:\Users\Admin\AppData\Local\Temp\debe4ceb4a7130aa9167feb43bbccf64.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\debe4ceb4a7130aa9167feb43bbccf64.exeC:\Users\Admin\AppData\Local\Temp\debe4ceb4a7130aa9167feb43bbccf64.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5195783041f5f63ca4b1ae935cc5fc7a9
SHA13b248df9f96d1ae7b9af8247849b1bb70e9af5a5
SHA256ac34fbfd7c60a8da1ea603805368e1605db2262598b1cbd25b6a902517f177e9
SHA512283042b6b744e25f206fcae8bdc26606d4f740d15814f185debc82cfbd18e64773d4675778658c81df269af61e0162d9fca8f6538fa609546d8b26ad5de45c6c
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
4.9MB
-
Filesize
2.2MB
-
Filesize
2.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
1.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB