Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2023, 06:59

General

  • Target

    611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe

  • Size

    441KB

  • MD5

    6d906bd5d8a13d4f606a3b97fae99ad8

  • SHA1

    611a9e4c291ecd531c6f8f19afc436ea303f5f08

  • SHA256

    e19411b76e85354c5d53a959772efca2ed0315a6e7f74c4bd421edc03022d623

  • SHA512

    eb35fccd3facb2b88c6d0600ae9f2ed188909b63b83f3800d63c37cbb05d596bc8582dc9f691532b3e79102088dcfcf06eb3026e90ecc40c6b29d31857f164ba

  • SSDEEP

    6144:B5aWbksiNTBTSJfzmTFZjI+wCtNNHxfLf0Gq0eMmv+bYR8Byaewr8z5PEtmprDWE:B5atNTFSJfzmTLTxxfo0eMqJut5CeE

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe
    "C:\Users\Admin\AppData\Local\Temp\611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\976.bat C:\Users\Admin\AppData\Local\Temp\611a9e4c291ecd531c6f8f19afc436ea303f5f08.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\extd.exe
        C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        PID:932
      • C:\Windows\system32\reg.exe
        reg delete HKCR/.exe
        3⤵
          PID:1060
        • C:\Windows\system32\reg.exe
          reg delete HKCR/.dll
          3⤵
            PID:1116
          • C:\Windows\system32\reg.exe
            reg delete HKCR/*
            3⤵
              PID:432
            • C:\Windows\system32\attrib.exe
              attrib -r -s -h c:bootmgr
              3⤵
              • Views/modifies file attributes
              PID:544
            • C:\Windows\system32\attrib.exe
              attrib -r -s -h c:bootmgr.sys
              3⤵
              • Views/modifies file attributes
              PID:336

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\976.bat

          Filesize

          45KB

          MD5

          2bdbce03c1b1106b7ab726fceaad814c

          SHA1

          3aac18f303b2037816b3d9cddc6d965a2567d625

          SHA256

          f6fbfe7d62597a81e63418936fc31863594906fcf2daefa79e9b39f23deb039d

          SHA512

          759118d4d0d086cdfdd23856ee3671c708ba78df2c2edacb76faef107c42c3c0d105e508f890da452c4ec19f9a3bc25639d9d757ab99793d34fd5daa1f5e9037

        • C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\extd.exe

          Filesize

          259KB

          MD5

          139b5ce627bc9ec1040a91ebe7830f7c

          SHA1

          c7e8154ebed98bea9d1f12b08139d130b6836826

          SHA256

          d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332

          SHA512

          8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b

        • C:\Users\Admin\AppData\Local\Temp\964.tmp\975.tmp\extd.exe

          Filesize

          259KB

          MD5

          139b5ce627bc9ec1040a91ebe7830f7c

          SHA1

          c7e8154ebed98bea9d1f12b08139d130b6836826

          SHA256

          d4b9b8b1f9ab2fbca7b55c4068bdcefae50ad3994924d67607fc9ae859003332

          SHA512

          8cc0e484ddb2e8bed4b8554e65ab8e3bfbe2a8f1c554a7aec9eac4c9555396e21c4bc2840d499ce4baffed2a4966a7d742c7c3ada58d039630b03472e322042b

        • memory/932-61-0x0000000000400000-0x00000000004A5000-memory.dmp

          Filesize

          660KB

        • memory/1532-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

          Filesize

          8KB