Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    11s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 05:48

General

  • Target

    72de7a1e06392946dbda10750c60318b.exe

  • Size

    2.6MB

  • MD5

    72de7a1e06392946dbda10750c60318b

  • SHA1

    b4fb0788605a63bb9d32d67f69d845fca7b9741b

  • SHA256

    9d12a2495919f42e952ebe1cd38785c912a639e92ead179081891027d1b87863

  • SHA512

    456cc5cf2bfd10998c312b4573c11b336b4b749aaeaad1de62ed040de2ed474785507cae7fbb731b6bee752afc09ce520e34c6f6036f4e1394f5918de2af7544

  • SSDEEP

    49152:NKydJAg5zPvhSPKuqk1vyXJ6ytJHOday3:nHuK5JSd3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72de7a1e06392946dbda10750c60318b.exe
    "C:\Users\Admin\AppData\Local\Temp\72de7a1e06392946dbda10750c60318b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\72de7a1e06392946dbda10750c60318b.exe
      C:\Users\Admin\AppData\Local\Temp\72de7a1e06392946dbda10750c60318b.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\72de7a1e06392946dbda10750c60318b.exe

    Filesize

    62KB

    MD5

    25bf98c1c4a9ad121e15f63b592dc0f4

    SHA1

    2ba83b06924f85d14d19aa14e768a1bb87286a27

    SHA256

    25d053f543f06e8a6789d4dfdf7c13ebccfaa26ce3264a9c649489bccbcf9166

    SHA512

    1b4bd4944a42fbfab2aa46586516ef05999ac3b569ed3e016f67d14416e3989366f7382cb17cc6ce5bc890361b2cb60dcf0638fe5bb7ea1b5daf0e28b23f4719

  • C:\Users\Admin\AppData\Local\Temp\72de7a1e06392946dbda10750c60318b.exe

    Filesize

    39KB

    MD5

    222069e73b50baa310f80ab694de3de2

    SHA1

    e25eec91fed06edc698a2be9334208df6ba88901

    SHA256

    405112162b0d2bf1e37d70fe501569492e7ba816d3b9fd8472f1c0d0238595a6

    SHA512

    4c3c11558323f426eb2936b5a96a2cbbfcd2ec1a7362fd0d9a457bc51ce09f82a0fc8089971be5b3a91084289f2af52de9f92a0be136541223c260f1712f7383

  • \Users\Admin\AppData\Local\Temp\72de7a1e06392946dbda10750c60318b.exe

    Filesize

    92KB

    MD5

    068295a2345159cdfcb47ba5d91b4863

    SHA1

    5a4e9ec262fc05ce6c19deba829c8ec67cc7688f

    SHA256

    389aede65429df24c4ca1d970db355c75d9316526cf82a7cad59b2c478b28a48

    SHA512

    4759d467171642b731ef2643b3b9e74e9e791e176c43eac3c63ec78806dc9507b693eaf48beaa7fafe925b922825eec135cc2f01e9118d63ee72df51ec5f274c

  • memory/1680-1-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/1680-3-0x0000000002240000-0x000000000249A000-memory.dmp

    Filesize

    2.4MB

  • memory/1680-0-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/1680-15-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/1680-16-0x0000000003B40000-0x00000000044DE000-memory.dmp

    Filesize

    9.6MB

  • memory/1680-34-0x0000000003B40000-0x00000000044DE000-memory.dmp

    Filesize

    9.6MB

  • memory/2284-19-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2284-21-0x0000000001FA0000-0x00000000021FA000-memory.dmp

    Filesize

    2.4MB

  • memory/2284-35-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB