Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-05-28...ba.exe

windows7-x64

9

2024-05-28...ba.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 13:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-28_db20666fae5b9fae78f8794cf71650b1_xiaoba.exe

  • Size

    1.1MB

  • MD5

    db20666fae5b9fae78f8794cf71650b1

  • SHA1

    db826ec3ffc592d1ffc6bdf06a5de22da963aeb4

  • SHA256

    2bc59961b8594d82ba54ebda5557cb067dd2bb1684356ae0c249bec95575f89d

  • SHA512

    1cff7f4e4a940f389c4cdec58b184b95ef888fc7375e8131516b277766e8d5be6d1fff0794c36bb2d4b74ff0d8e6440f0f24a747f684dee47de9b1f9e77fb0bb

  • SSDEEP

    24576:kfZanlLXYSKEDRWTg+YeP/YkOqLKPbu6MGYP:kPSKRM+Y2ZPLItC

Score
9/10
upx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 25 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-28_db20666fae5b9fae78f8794cf71650b1_xiaoba.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-28_db20666fae5b9fae78f8794cf71650b1_xiaoba.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1660

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1660-1-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-0-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-7-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-5-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-2-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-3-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-15-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-31-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-9-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-22-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-42-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-47-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-43-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-40-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-49-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-35-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-36-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-33-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-29-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-26-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-21-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-19-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-17-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-13-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download

  • memory/1660-50-0x00000000002D0000-0x000000000030E000-memory.dmp

    Filesize

    248KB

    Download