Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 19:32

General

  • Target

    212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe

  • Size

    5.7MB

  • MD5

    008b1c8c35a686911728b7a4801ce533

  • SHA1

    3b4d78ad91de2e9d901e55c760df1b1fe8683114

  • SHA256

    212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9

  • SHA512

    755bf055113e6c0e886bf779d5b1ebdc44f83f5447aad62f2e58ffc315123839a9fa7af69ed53ccc905b1e299a8025be6e3cab7eeb065890d9b5f13ca3e5a70b

  • SSDEEP

    98304:llaCCCCCCCCCCCCCCCCCCCCCCCCCCCCCHffffffffffffffffffffffffffffffF:lQCCCCCCCCCCCCCCCCCCCCCCCCCCCCCl

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe
    "C:\Users\Admin\AppData\Local\Temp\212142fac0cc12f92efb2776927269f41aa5a6bde0bee3ae29638926bde3adb9.exe"
    1⤵
    • Drops file in System32 directory
    PID:3592
  • C:\Windows\SysWOW64\svrwsc.exe
    C:\Windows\SysWOW64\svrwsc.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\svrwsc.exe

    Filesize

    6.1MB

    MD5

    6ad1da63bdc6dde20d9097f199cbfd33

    SHA1

    11a1a6424d90e2c5cd5ceeb29d4d8c7468cfdc62

    SHA256

    7d35fb94980ce24abca53da8c8bddeb8e75f0d1bbf6a8ba477bb422bf34c261b

    SHA512

    9e9b8fad03b48be543ea2b0b5c4b1dec1d9a9b23020817b7688bbd0b75838d80f05d59d86baac98ca56304e029acbfea9bd9b04bb9e9665c1e3cbf35f77f8c07

  • memory/3592-0-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/3592-1-0x0000000000790000-0x0000000000795000-memory.dmp

    Filesize

    20KB

  • memory/3592-9-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/5100-4-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/5100-6-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB