Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 04:00

General

  • Target

    5f6be08e89d6c97292f1c3fde3bf19d0.exe

  • Size

    3.2MB

  • MD5

    5f6be08e89d6c97292f1c3fde3bf19d0

  • SHA1

    a246dc29e35eddc0c275114f2654d922b550df6c

  • SHA256

    b17abcf6553d41bccdef45fbf48314821b4a65679e1be96985039d1d4236abe5

  • SHA512

    15df529c2fbf6577a389fdd1614fcd83f4bc2496608c222c8079a773fb726d7d706fb3dbfa860f85a281f4d7725ab4404cdb7c0e02615c53cc8ebfe101d0bf02

  • SSDEEP

    98304:hjWDRJgTp0cakc2G6pfFmcakchzHxcrz9GMMcakc2G6pfFmcakcO:hGSTp0dlAfcdlhzU9GNdlAfcdlO

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f6be08e89d6c97292f1c3fde3bf19d0.exe
    "C:\Users\Admin\AppData\Local\Temp\5f6be08e89d6c97292f1c3fde3bf19d0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\5f6be08e89d6c97292f1c3fde3bf19d0.exe
      C:\Users\Admin\AppData\Local\Temp\5f6be08e89d6c97292f1c3fde3bf19d0.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\5f6be08e89d6c97292f1c3fde3bf19d0.exe" /TN m8v9k5kD0c8e /F
        3⤵
        • Creates scheduled task(s)
        PID:2752
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN m8v9k5kD0c8e > C:\Users\Admin\AppData\Local\Temp\cEGfa.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2276
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN m8v9k5kD0c8e
          4⤵
            PID:2400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5f6be08e89d6c97292f1c3fde3bf19d0.exe

      Filesize

      78KB

      MD5

      42727b0ace5e61d618e08a9498e97a60

      SHA1

      0093f5ecdf83742140ddc3435bfd72fbb6832469

      SHA256

      b559496503ecfad48731d9a12578e450ab62ef88273ac69f87866007ad08864a

      SHA512

      12f1415d1ea186ad40f2daffb75c7acb87a2256b6ed9887cd73156459e665601ee1dfa16b222012110b005899f347c90806652cb8f90ee5eb1775c666eaa504f

    • \Users\Admin\AppData\Local\Temp\5f6be08e89d6c97292f1c3fde3bf19d0.exe

      Filesize

      139KB

      MD5

      26e2325cab763b3de0746bc32fb3d5ca

      SHA1

      3542efe38ae79cccbeab551347a6c799dfe68766

      SHA256

      68a147efadf0165e90a908f7761b3d6839a63910deda88eb450d6faf563bb869

      SHA512

      6207a39f7153b0b4ef56f5d598f26a3e8c01d41cb151d34fb8223746200b1e6da3e08c95fcd7b7cef53a06a9ac8844905b17ef0bcb68619e582a2dcbd5e98df1

    • memory/1736-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1736-16-0x0000000023680000-0x00000000238DC000-memory.dmp

      Filesize

      2.4MB

    • memory/1736-2-0x0000000000280000-0x00000000002FE000-memory.dmp

      Filesize

      504KB

    • memory/1736-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1736-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2700-19-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2700-21-0x0000000000270000-0x00000000002EE000-memory.dmp

      Filesize

      504KB

    • memory/2700-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2700-29-0x0000000000360000-0x00000000003CB000-memory.dmp

      Filesize

      428KB

    • memory/2700-53-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB