Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    201s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2023, 04:50

General

  • Target

    87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe

  • Size

    268KB

  • MD5

    f2e436ae20f182467c21935ab2dc3a9c

  • SHA1

    9bdc93885b2160c947d47425ff185ca686c94474

  • SHA256

    87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a

  • SHA512

    d02bb1d3b3c7ebf0fa0ee6217985762cc6f5c1781f011b94945b4fba1afc937d7f88f7ae9be1cdae4411085e6476eee2f3eeba5a89b333b98f3d317ddb4ae5cc

  • SSDEEP

    3072:CRcFjF23Cf63BMP1BRIG/OnuUHigj5ZBfThXhXXQjAAEV3yn2KFgqgEBIObRQ6cZ:wcFjwju1BRIG/OpRXgjqALgqBvA

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe
    "C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe
      C:\Users\Admin\AppData\Local\Temp\87b08ae016474b168d3c7bb0e913ef5a0c7c5d639f11896be5e00232a626d88a.exe None
      2⤵
        PID:1988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

      Filesize

      717B

      MD5

      60fe01df86be2e5331b0cdbe86165686

      SHA1

      2a79f9713c3f192862ff80508062e64e8e0b29bd

      SHA256

      c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

      SHA512

      ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7244112A23658996B30F276F5B84FA23

      Filesize

      503B

      MD5

      290c7a5f423b2f789dc7d50475fe75a4

      SHA1

      ec77f5f9fe41847e6181e9fcca5dd772fe238f0f

      SHA256

      cdb4b50934527022b1fc4277f1f2001fca6c5e55b4ef50b4a02bdb93f5a9434d

      SHA512

      ada7061471ae69649a70260a950d85806f3baa6415797af89a89063d577ff19cd2f6e7d9cb44f721b47b84da9b8df749c92cdb4ac12ddcb4d54f4b45eae12640

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

      Filesize

      192B

      MD5

      879594618ceccde554b4d64e528e088e

      SHA1

      e69c56047a032654abe313c124c4c7e5c6e3cfa9

      SHA256

      2532e2fa5cd8abbc89e5e716d9d627c5bdce507e482aa32ee616fde04557d64f

      SHA512

      d2961d3430ce6050acc57d8e22ea249617f1c84802b46a306bac66a10c4dac0ecf9cd37d0b28aa0742fa818e16ceb1d70c4d1ababae191d5066c1feb7c8df21e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7244112A23658996B30F276F5B84FA23

      Filesize

      548B

      MD5

      5305dab577dd4d3319d3a85cf3a2fe90

      SHA1

      80b7b0cc6e2de9d2b27fe1a571f2d6acd2f0aca2

      SHA256

      06ab0d19dd264e3aead81436a0d496ffa06752a6a2d4754aa1151c81c630df5c

      SHA512

      1e91533f4951d16b4b880463618385faf5b9da31c34ec1ff39eb921ab10bde83c752a4e9b15b41b280574498e60750bfc5fbff5c0faa39dcf6aef192a15e337f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      82021ff00313b2bdd297ba1db4af05c5

      SHA1

      01c3648b48ca3c448e74a7753c0e92a40bae7fda

      SHA256

      b573004588e5f142ed244f172e3629bc4a59c4695a5824c4a3dca9382575d4e1

      SHA512

      99889edf64ebcef15d3c800c3f0411c500b7a553e8a588a34a1ece5deb432b00fe21813327d94ee136aedc8c9fc83636c9820c9ae12593edac08b7cf736e3f04

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6ed238c0142436697c1d7ed673733d48

      SHA1

      beb4dc629c3342c7bad9e7327ffe4907a1627985

      SHA256

      c22239db89dea496720fb3d4b45fd7ca565be6f263e98270570eae7e6a9f6a50

      SHA512

      5afcd2915cabb0d72af01185fa56357d7426ae264c9e3cf0a0346feb23e4ce6b31008404dddbe02850a53abcc7b9378883117f17f37f3cf00d2dca70c0addce8

    • C:\Users\Admin\AppData\Local\Temp\CabFD45.tmp

      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Users\Admin\AppData\Local\Temp\TarFDD4.tmp

      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TSOYZYES.txt

      Filesize

      831B

      MD5

      4cf2308bf52dedd6a9c7d7cf76d996b0

      SHA1

      70ad871701e7c2e7fabf869f8cb96ab917cc1370

      SHA256

      c23a08b7e3fd8dc45a26fda238952d9208b86b8dab2e4eeea03b7e280bc6f1f5

      SHA512

      dfa5dc8b72eb2f374d2bc254f1100484a1aee9bc87323ae57ea95f14c6cf8bb2aebf34203643652ec2f306f32f48c2321dbaee9aad46c85540d6aef8ad43806a

    • memory/1988-117-0x0000000000360000-0x000000000037D000-memory.dmp

      Filesize

      116KB

    • memory/1988-118-0x0000000002A90000-0x0000000002B1D000-memory.dmp

      Filesize

      564KB

    • memory/1988-120-0x0000000002A90000-0x0000000002B1D000-memory.dmp

      Filesize

      564KB

    • memory/1988-119-0x0000000000360000-0x000000000037D000-memory.dmp

      Filesize

      116KB

    • memory/2380-80-0x0000000000440000-0x000000000045D000-memory.dmp

      Filesize

      116KB

    • memory/2380-79-0x0000000000440000-0x000000000045D000-memory.dmp

      Filesize

      116KB