Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    200s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 13:09

General

  • Target

    cd88edb1ea2dd9fabd70c4110858a2bb9ded972931991292d4aa8a198388e52b.exe

  • Size

    28KB

  • MD5

    bec986bf58fea6d3c86e18574389a286

  • SHA1

    b94ae9de04c9c1cc992fa96ca2abfa4f13c04845

  • SHA256

    cd88edb1ea2dd9fabd70c4110858a2bb9ded972931991292d4aa8a198388e52b

  • SHA512

    d7501915d03c9cb0f53ffdfddc4cf2af5f36fd94c78c0d42d754b5e6084dfa138c7017e71b27f43b1a2e819991ca26de3bd6cad31bf030e4cd13599391451660

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNCnf4Z8P:Dv8IRRdsxq1DjJcqfXwCP

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd88edb1ea2dd9fabd70c4110858a2bb9ded972931991292d4aa8a198388e52b.exe
    "C:\Users\Admin\AppData\Local\Temp\cd88edb1ea2dd9fabd70c4110858a2bb9ded972931991292d4aa8a198388e52b.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    c8c2455cdb5d932dfe13d08cd520700f

    SHA1

    85caecd4c8774ec09dd2bc4c041f6a7e65afa78f

    SHA256

    5508b89c31a46e83e726cbe8e7a666bc316d43ac421045719cb4c55f3f718a43

    SHA512

    15e3e14fd77010d494ffef14a8c1de22f1b87bd5c526202c17f694c2c964d49138762b7227dd199bc01a31f86f6bf5539bda490505016336eb10cb67bcc37c50

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    e06a04c1d429244b90e9cefc61354809

    SHA1

    9bc386bfa00056dbf9aeabf9b0b2667556594407

    SHA256

    fa75f787fe05a125a8cbe691583b6d8af783026d58da6d56d996f1e36ed52980

    SHA512

    2b532df59208c8d2bac77f78c2ec2c04f5f29ca8bf2e43ddb4464f8c9679589de2c20184f574af9e375ea31c32291185e7cece72ba4339f0fc497d19e6e9028f

  • C:\Users\Admin\AppData\Local\Temp\zincite.log

    Filesize

    1KB

    MD5

    e577af5df75ff333455caf78939ae5ad

    SHA1

    b32cc9e6be200b8561647108b62ac1b294643ae9

    SHA256

    b793310a7f94cba4f97ff039d0601c9a9038b310d797aa8d5433abaf5e9cd25a

    SHA512

    5425bddcc08d21b0c268118474971ff1d1da54a32721086af18c3cbf4056577c42a2eec8b5fea07ce45e11dea840d244249d8b1717787cecc2d3e1934df5f9eb

  • C:\Windows\services.exe

    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1608-61-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1608-64-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/1608-57-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

    Filesize

    8KB

  • memory/1736-60-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/1736-59-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/1736-62-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/1736-63-0x00000000001B0000-0x00000000001B8000-memory.dmp

    Filesize

    32KB

  • memory/1736-58-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB