Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2023, 19:37

General

  • Target

    4ef4bb360805a70541e40eb802d59b40_exe32.exe

  • Size

    9KB

  • MD5

    4ef4bb360805a70541e40eb802d59b40

  • SHA1

    bc9935d3a5c7497a1fab8b2b18d21e5da5931f8e

  • SHA256

    f499faab313a256c2a684913fc0cade15ad8efd61b99b87114d2af2c51667415

  • SHA512

    5221056d382179b0fa61b517070401344bd865e28272e88a1a26d7a80c472948e5d053e0e6b4bbe4c5b8e1822ed4e150b9171967e706c0a15adb9c5bfb251f0d

  • SSDEEP

    192:HLCUdKBYJsw4t4UjdBr8lk2wgHveFaNJhLkwcud2DH9VwGfct85ySkpV:HRKqdUhBP2wPaNJawcudoD7UIySQV

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ef4bb360805a70541e40eb802d59b40_exe32.exe
    "C:\Users\Admin\AppData\Local\Temp\4ef4bb360805a70541e40eb802d59b40_exe32.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe
      "C:\Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\4ef4bb360805a70541e40eb802d59b40_exe32.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4431.tmp\batfile.bat" "
        3⤵
          PID:2948
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\selfdel0.bat" "
          3⤵
            PID:2556

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • C:\Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • C:\Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • C:\Users\Admin\AppData\Local\Temp\4431.tmp\batfile.bat

        Filesize

        367B

        MD5

        1a74e6f043e5fc8c05e07cc71c0a432f

        SHA1

        733dafe0964816b343e6c992769d61c786cdf7ce

        SHA256

        63117cf2fb22ec54283b1b32d09cd35da32a96bc310c1a14b454c5219cf7a4d2

        SHA512

        00d2bfd3e6bfede107f1aa18dc4b3b851f29438b73b74b11cacf658434af4ef897ebbd64017a3b4e5707cdd50202bb1aa38ce0ffc1986a72ca1f5e26a0ea6f29

      • C:\Users\Admin\AppData\Local\Temp\4431.tmp\batfile.bat

        Filesize

        367B

        MD5

        1a74e6f043e5fc8c05e07cc71c0a432f

        SHA1

        733dafe0964816b343e6c992769d61c786cdf7ce

        SHA256

        63117cf2fb22ec54283b1b32d09cd35da32a96bc310c1a14b454c5219cf7a4d2

        SHA512

        00d2bfd3e6bfede107f1aa18dc4b3b851f29438b73b74b11cacf658434af4ef897ebbd64017a3b4e5707cdd50202bb1aa38ce0ffc1986a72ca1f5e26a0ea6f29

      • C:\Users\Admin\AppData\Local\Temp\selfdel0.bat

        Filesize

        158B

        MD5

        588a5f3689568d468934c4871529f53c

        SHA1

        499054df38ee8b2da96d46b30585ace1ff5e37ff

        SHA256

        72d8573bec3df917d650e6d903be37aeff1c83647a63cfd2ac7143c7db2d70cc

        SHA512

        037a2b508fa4495eee9f1d820c5261898bf8b9ad511e1bccde759ae80bbb1229cd730b2e9e9ffc5c1979cc1b43c004e9e2098c5bb21752bdd81f39a0f4669bcc

      • C:\Users\Admin\AppData\Local\Temp\selfdel0.bat

        Filesize

        158B

        MD5

        588a5f3689568d468934c4871529f53c

        SHA1

        499054df38ee8b2da96d46b30585ace1ff5e37ff

        SHA256

        72d8573bec3df917d650e6d903be37aeff1c83647a63cfd2ac7143c7db2d70cc

        SHA512

        037a2b508fa4495eee9f1d820c5261898bf8b9ad511e1bccde759ae80bbb1229cd730b2e9e9ffc5c1979cc1b43c004e9e2098c5bb21752bdd81f39a0f4669bcc

      • \Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • \Users\Admin\AppData\Local\Temp\42CA.tmp\b2e.exe

        Filesize

        8KB

        MD5

        b861226487012dd40e26ace365812e80

        SHA1

        f7e362ffe7180435063edca4fc12ef161b81794f

        SHA256

        7caac5dd211cad7e695689349b79004b4987f60d5806c220f3295be2647c7c85

        SHA512

        be1df54852ba6cf859bc573f94ac2134fdca5137c998409130fb0fc6c610188121278df29aceaed01dc5b1332daf52aa56200f44505b4b987344a497aa59102e

      • memory/2312-11-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/2312-0-0x0000000000400000-0x000000000040B000-memory.dmp

        Filesize

        44KB

      • memory/2312-5-0x00000000003C0000-0x00000000003C5000-memory.dmp

        Filesize

        20KB

      • memory/2844-14-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB

      • memory/2844-38-0x0000000000400000-0x0000000000405000-memory.dmp

        Filesize

        20KB