Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29/05/2024, 03:02
General
-
Target
f7a76577a371c6f5f833d85b50c7613d8c90e744f8a988112ddf1f3c619239d5.exe
-
Size
13.4MB
-
MD5
7377b1e9953e1d970f1bfddb757fa044
-
SHA1
a267f7a162984b29332e6c3281d3b051e487a9f6
-
SHA256
f7a76577a371c6f5f833d85b50c7613d8c90e744f8a988112ddf1f3c619239d5
-
SHA512
6dcdf13c4435e1f175d0a57980678ddba11dfe7ec19f9117840778220df8817fbe3864c911c443127d50254ab6c027994ebde51d6437a8522bb66312bd970dea
-
SSDEEP
393216:/kpuAy0ztGnT6g0Knjp+/uP+RQGPA0vo+zn6kuSF//cauM:wbQnT13F+/g1U65w3cg
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7a76577a371c6f5f833d85b50c7613d8c90e744f8a988112ddf1f3c619239d5.exe"C:\Users\Admin\AppData\Local\Temp\f7a76577a371c6f5f833d85b50c7613d8c90e744f8a988112ddf1f3c619239d5.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Çå·ç³ÁĬ΢¶Ë\f7a76577a371c6f5f833d85b50c7613d8c90e744f8a988112ddf1f3c619239d5.exeC:\Çå·ç³ÁĬ΢¶Ë\f7a76577a371c6f5f833d85b50c7613d8c90e744f8a988112ddf1f3c619239d5.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5cd81767f8622b1c76a29e6cb6b719c49
SHA196d671cd62e7e15a2827b9cf3849ef026b38aff3
SHA256247a026c986309a35d3a8579bea1c6e198786b8509120e502bc08f97ccc2663c
SHA51252ec3a0f18babf6af987fe06bf276b0460661371a7e4aa9773d9a825c41439e042b9e7f565914a070516723c4f004df75946e403a59fe5e1b449ce2269054e3c
-
Filesize
102B
MD5a7949392dbe15cc39cae4dd0a464a16d
SHA1b244d62c86ed285e213d24e50b5ba92f1e6be680
SHA2563a101a04406906237bd364502a81837cadbfb529d99ab0ca7816c9608565cdb7
SHA5120680aaf0c0ce1bce273513aa6fc8e0e45c2e5cd42ec696dd8e5b999434c219a8d2b86eb90ee2169117401f3ab55fe10db0290763d3fced47bd659a42cb2f3938
-
Filesize
13.4MB
MD57377b1e9953e1d970f1bfddb757fa044
SHA1a267f7a162984b29332e6c3281d3b051e487a9f6
SHA256f7a76577a371c6f5f833d85b50c7613d8c90e744f8a988112ddf1f3c619239d5
SHA5126dcdf13c4435e1f175d0a57980678ddba11dfe7ec19f9117840778220df8817fbe3864c911c443127d50254ab6c027994ebde51d6437a8522bb66312bd970dea
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB