Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
26/03/2024, 14:49
General
-
Target
df6cad8163fa73b93e27fb6929498dbf.exe
-
Size
6.5MB
-
MD5
df6cad8163fa73b93e27fb6929498dbf
-
SHA1
c5a344c87b24d175e9af990566765bfa6a004e3e
-
SHA256
fc07b8d433cff92b5789b3691302f0cff4cc80cf84887860656159aacd83cf04
-
SHA512
ca46e4fd92c67c5b016e5f097d033400e64c5317e7b9d114957a017784e9ff3994a8c4c1e73fe97268ef890bf12094545d7b66ff8c1809149a5b62709c398ded
-
SSDEEP
98304:992r9db/Brr2aVm2VG7CJLuM1Fg2R5xR43JOZqEKhV2aVm2VG7CJLuM1Fg2O:I7prrXVmdCJ1g+xR44cEKTXVmdCJ1gr
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df6cad8163fa73b93e27fb6929498dbf.exe"C:\Users\Admin\AppData\Local\Temp\df6cad8163fa73b93e27fb6929498dbf.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\df6cad8163fa73b93e27fb6929498dbf.exeC:\Users\Admin\AppData\Local\Temp\df6cad8163fa73b93e27fb6929498dbf.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD59914e42d3497fbb541b4a5f59606cfe4
SHA1fd82d142e6668762c72905aabb93f46172502e80
SHA2568b7a6e099b0e4442ba32bc2d545b57972a74ffd188d6c37cfa3c03c52242e2df
SHA5128edaa2203885026283a26994786e54fbd38fe7da10e149eb018f913b7bf719fa1faa58edc5adc7d5675ea4e53316c422b2815c69fe5133eddfaa5f912d7023ed
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
2.3MB
-
Filesize
2.2MB
-
Filesize
2.3MB
-
Filesize
4.5MB
-
Filesize
2.3MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
2.3MB