Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 04:43

General

  • Target

    666fb8cc7a72d37b7834809b3a052967.exe

  • Size

    7.8MB

  • MD5

    666fb8cc7a72d37b7834809b3a052967

  • SHA1

    f88a4e9a37c168a9722ac708f123f53f67f8c1cf

  • SHA256

    a6e76b3a56763a2bf329cd6bd9e11b668e5e03986749eff93ec87ef0e0fff5a5

  • SHA512

    7316f7ae86e74a23016aec5bd7cb0cd1df5e3fcddad4dec2ead18dc798ad39828ba5b6e9eb20105bc038db71bdc19e1ff2ec7963cdcb21548085b4c0bd8114d4

  • SSDEEP

    196608:U0X0EXGdlirybMgOnkdlirzhdlirybMgOnkdlirAmclo7sdlirybMgOnkdlirzhI:U0XdXMbMrnxbMrnpaxbMrnxbMrn

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\666fb8cc7a72d37b7834809b3a052967.exe
    "C:\Users\Admin\AppData\Local\Temp\666fb8cc7a72d37b7834809b3a052967.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Users\Admin\AppData\Local\Temp\666fb8cc7a72d37b7834809b3a052967.exe
      C:\Users\Admin\AppData\Local\Temp\666fb8cc7a72d37b7834809b3a052967.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3044
  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\666fb8cc7a72d37b7834809b3a052967.exe" /TN U5Z8sQiHf24d /F
    1⤵
    • Creates scheduled task(s)
    PID:2724
  • C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c schtasks.exe /Query /XML /TN U5Z8sQiHf24d > C:\Users\Admin\AppData\Local\Temp\u3rxJnVc.xml
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2816
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /Query /XML /TN U5Z8sQiHf24d
      2⤵
        PID:2848

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\666fb8cc7a72d37b7834809b3a052967.exe

      Filesize

      118KB

      MD5

      17b19f2bbdd23949aba14267f4441ce8

      SHA1

      6c09ba07736317898b7fcb660d581bd8c2dcd2d5

      SHA256

      7d9c6b5d9e55c106d9e3ef0bf5f4370ba1c0760254bc8f72f6119f077ac7ae95

      SHA512

      3ce43193d3631a3e388f014b503bdac7a70f0f048361ba7c62ddffa094ea149ea2df6293f435de63d497d57a731d81c90408c020df4a5730d51899e501319a92

    • C:\Users\Admin\AppData\Local\Temp\u3rxJnVc.xml

      Filesize

      1KB

      MD5

      a5ce0d5ce5f86541f34b0ce759f92e91

      SHA1

      2b6946281034688f41ed30bcc34fe4111e4c1e96

      SHA256

      41e4f7d3ecf9b6b8422be1c46510e425bc77311f53a091efe1c2999fa33d2380

      SHA512

      fe43fac2a3606750fd5254af70822eb1da5716c139c7e1c3d66abe88b209bd19207ab9985c4d9322f6058f73631e14cfa0c95e0ee52f8f9595f2df1e34aa1096

    • \Users\Admin\AppData\Local\Temp\666fb8cc7a72d37b7834809b3a052967.exe

      Filesize

      191KB

      MD5

      e6ee3e58eb6e44200035f6f6d1f79316

      SHA1

      e8b5d29c94765fb23ee6b6f83be2dd4e7b5a0eb2

      SHA256

      a19e4db1e48513413c9eef4b31742fe75b7a79d6468be4815f7d132f9a9a29db

      SHA512

      94a3a8241ad12349031972c9d7be3f2f9ae4b8f2cd09e258374d3f0c23270374dea417f201fbbdb3f17d97ddb9b9f99575964686b2ccd506f409b1d412e8224c

    • memory/2904-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2904-3-0x00000000002D0000-0x000000000034E000-memory.dmp

      Filesize

      504KB

    • memory/2904-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2904-20-0x0000000023E80000-0x00000000240DC000-memory.dmp

      Filesize

      2.4MB

    • memory/2904-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/3044-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3044-22-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3044-31-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/3044-18-0x0000000022D90000-0x0000000022E0E000-memory.dmp

      Filesize

      504KB

    • memory/3044-54-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB