Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2024, 00:16

General

  • Target

    90414a92f7a26e8b306797e294ea0c29ff63a61e3882ceb654b1996583ec4327.exe

  • Size

    174KB

  • MD5

    c370c9b411a32b42fb361befbbe2f58b

  • SHA1

    3823c66c23db10bc0238a1c0cfceb6a2375b5f7b

  • SHA256

    90414a92f7a26e8b306797e294ea0c29ff63a61e3882ceb654b1996583ec4327

  • SHA512

    4f880a05d129ab5c4d5677c9e4216d8743684a4a0d571356d78999b7e2826a9bbf85a1d689ba82d34a2a421d0b0a87bb4445bd53a8de2276b60d546dd625bc87

  • SSDEEP

    3072:rPQreMTKVOq8R9MOF2lozi6K0Hbe0kcWqma5mPFeI8nll/iOTuoC9wVGKXk6S/9U:rPnMCkmlotP2a5mPF1Ql/pCmd0Vq

Score
10/10

Malware Config

Signatures

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\90414a92f7a26e8b306797e294ea0c29ff63a61e3882ceb654b1996583ec4327.exe
    "C:\Users\Admin\AppData\Local\Temp\90414a92f7a26e8b306797e294ea0c29ff63a61e3882ceb654b1996583ec4327.exe"
    1⤵
      PID:2996

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2996-0-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2996-1-0x0000000000400000-0x000000000042C000-memory.dmp

      Filesize

      176KB

    • memory/2996-2-0x0000000000A50000-0x0000000001B0A000-memory.dmp

      Filesize

      16.7MB

    • memory/2996-3-0x0000000000A50000-0x0000000001B0A000-memory.dmp

      Filesize

      16.7MB