Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2023, 11:01

General

  • Target

    e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe

  • Size

    3.6MB

  • MD5

    168eca82af2c03881fecdec4447ff9a5

  • SHA1

    aedaae101d8e757efa03cb6641739cce65870228

  • SHA256

    e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271

  • SHA512

    a5260cec69a6a8bf23a47eaadd7eafc08673faf25c0d97d3f5ae7fbfe09c7ae8b3ee6298acf368acb2c076a4abd91336e07983da69d68901d4e0680460ac7151

  • SSDEEP

    98304:a+EgW6sZe9fcMrrwtTBruYPziOOo/s+I09KZB6v6JIUC0:aWdsZeJcMrrCTBtiOObvtZIv6J7/

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe
    "C:\Users\Admin\AppData\Local\Temp\e498405131d7571c1e77bcd564d48c7fbd8559057a9d3cb8971d7a6aa9a1a271.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\SysWOW64\regedt32.exe
      C:\Windows\SysWOW64\regedt32.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1380

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\RSkinFSystem.ini

    Filesize

    129B

    MD5

    78d89536fa344a82364f1dda81d78f3a

    SHA1

    e866b4f7713f3b6718c2b4b836937c8b35ff7c31

    SHA256

    32c064c7c56cae4ea4ee32cf8ee2f110f2f715ed064c28c1a5e5b4b384439fa5

    SHA512

    2a04d9ea26e8617c60f5af189f2fce74baf151bb414390aa617adf140bce277d492764dc7a34671d0a09c61edebbd0b9f8d3ce591a2d6d54f66495f53cce6d58

  • C:\RSkinFSystem.ini

    Filesize

    129B

    MD5

    78d89536fa344a82364f1dda81d78f3a

    SHA1

    e866b4f7713f3b6718c2b4b836937c8b35ff7c31

    SHA256

    32c064c7c56cae4ea4ee32cf8ee2f110f2f715ed064c28c1a5e5b4b384439fa5

    SHA512

    2a04d9ea26e8617c60f5af189f2fce74baf151bb414390aa617adf140bce277d492764dc7a34671d0a09c61edebbd0b9f8d3ce591a2d6d54f66495f53cce6d58

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cf1ff340412263951a6f539d699deb28

    SHA1

    de7c317ca15cb28a26a7af2f3555c1325d010de7

    SHA256

    3c5a31934cac4244cd2ab3a0778c32a9d4fee414388d0f9326166b601762aec4

    SHA512

    4048d2348b74aa5b3f4797cb506597a6c65a2f385e0c93e31b177578e2bbe95bd45e80e4fe89fe036ad8a76bede9efd6b421e4ecb6010df5ee701e965a6a4daf

  • C:\Users\Admin\AppData\Local\Temp\2488_update\7z.7z

    Filesize

    3.4MB

    MD5

    f4ece332b5112f8cf6e3173fa883bafe

    SHA1

    29fe526543de54f8f52d0405c0b0a4f23b9c5fa5

    SHA256

    c330d1a5155944c8cc7fd850fe69d291d451042174c1893b6418f82423f376c1

    SHA512

    380f4c1d62a1282ce718d5770bbb7e65148989ce6a53c144324bd95844b9446dd63c6afe965de3e7780eef91bf8a5d7e8e8252bfb4f7ef036d97d904351704e6

  • C:\Users\Admin\AppData\Local\Temp\2488_update\data.ini

    Filesize

    177B

    MD5

    3afd57e38d08f539c0ef64c64e784266

    SHA1

    7285aadc714a9c124af342a993c17a2d815fb355

    SHA256

    c31e70edc39c1053f31a71c5d29dbf76e25b7ac8e78bbd34a825f15407745d85

    SHA512

    9155c3f917d91889020af4471045f2b9ff851c57d06e3b03b172da44bb4b55329de9526f60b2d0ea521ae6f3a4ccf204c31fb31c805d7285bbe5f3a22d733c6d

  • C:\Users\Admin\AppData\Local\Temp\Cab6589.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar6647.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • memory/1380-174-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

  • memory/1380-181-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1380-185-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

  • memory/1380-180-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

  • memory/1380-177-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

  • memory/1380-171-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

  • memory/1380-169-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

  • memory/1380-167-0x0000000000400000-0x0000000000503000-memory.dmp

    Filesize

    1.0MB

  • memory/2488-3-0x0000000000400000-0x0000000001039000-memory.dmp

    Filesize

    12.2MB

  • memory/2488-142-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-163-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-155-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-147-0x0000000000400000-0x0000000001039000-memory.dmp

    Filesize

    12.2MB

  • memory/2488-146-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-161-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-139-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-158-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-143-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-144-0x0000000010000000-0x00000000100BE000-memory.dmp

    Filesize

    760KB

  • memory/2488-184-0x0000000000400000-0x0000000001039000-memory.dmp

    Filesize

    12.2MB

  • memory/2488-0-0x0000000000400000-0x0000000001039000-memory.dmp

    Filesize

    12.2MB

  • memory/2488-1-0x0000000000400000-0x0000000001039000-memory.dmp

    Filesize

    12.2MB

  • memory/2488-2-0x0000000000400000-0x0000000001039000-memory.dmp

    Filesize

    12.2MB