Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
22/05/2024, 21:18
General
-
Target
49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe
-
Size
209KB
-
MD5
012e63c1d3251c98cc4bc9b07c242c4d
-
SHA1
5e5102af77c3598ee08a24e163d9181c0bac3868
-
SHA256
49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed
-
SHA512
ad7f60b20ffdcc6179099ea89180eff9a868000afa22a766b09d02f628a2f781a015f9dadb0e48f880126d118580987a15983005f8f5b2426ec128323c7c18c4
-
SSDEEP
3072:+z2g4cXOQQTW9b43i7KG0hcmEnFpyzc4jPCWZo/Wh+jxGCuWefXZV+s:02gCtTQb5KG8EborCW2WhPtfXp
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe"C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exeC:\Users\Admin\AppData\Local\Temp\49c59699c3a5e2cc0666a12f75ed69a674138a194d40906e3b7843730a5363ed.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5eae325f8ec5619ed19bf3a304b549cf1
SHA11aaae0a0a496810a81e73b5a4f0b242c4f4bc2a1
SHA2569819bae927e469f4ceb3315000d4f063745b603cc6bf0c3341ca578601d2f860
SHA512711a4b2a5fda0e050a3f401e2d96344de0086a0f0042872d100f24a24c0b5b4de7d6cdc7dec932bafc14a6633e5d403983174baf7e3f378bd9abf7d91cc0694b
-
Filesize
256KB
-
Filesize
104KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB