Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 07:25

General

  • Target

    791b5d254d26c587d6ed6a85ed95c680.exe

  • Size

    2.0MB

  • MD5

    791b5d254d26c587d6ed6a85ed95c680

  • SHA1

    4ac10b0d90e40b56bcfca407bff107541687df53

  • SHA256

    adea4fca625dd47fb7188c900a76eea4ffab31e952e129bd0775646ad1241e1c

  • SHA512

    ae86d2e16f144699eb08c64b58405f70e3a0150c88dbb5b0f07e232637cd0bcb20ab541225acb2af9c07a9ed25b7aa9f10df4c5797b03f276e69719685a643e2

  • SSDEEP

    49152:RKYR/IJMIM9jwBlXd3sToyPc0DpidVpO8xplMIM9jwBlXd3s:RT/IJM9cB51Drsi7pXxplM9cB51

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\791b5d254d26c587d6ed6a85ed95c680.exe
    "C:\Users\Admin\AppData\Local\Temp\791b5d254d26c587d6ed6a85ed95c680.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Temp\791b5d254d26c587d6ed6a85ed95c680.exe
      C:\Users\Admin\AppData\Local\Temp\791b5d254d26c587d6ed6a85ed95c680.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\791b5d254d26c587d6ed6a85ed95c680.exe" /TN U5Z8sQiHf24d /F
        3⤵
        • Creates scheduled task(s)
        PID:2744
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN U5Z8sQiHf24d > C:\Users\Admin\AppData\Local\Temp\DQCEhw.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2672
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /Query /XML /TN U5Z8sQiHf24d
          4⤵
            PID:2088

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\791b5d254d26c587d6ed6a85ed95c680.exe

      Filesize

      870KB

      MD5

      91cdb52cf7b1351245ae195d677bee1e

      SHA1

      5204e72d046d7043fd615c3c63e6929d6f161880

      SHA256

      87b9f3239db0b42fb1480bc95873eb6d73dd62a537088e2363fecb0e765c4e10

      SHA512

      ca1352bc4b783ad62ff2f2f9da0e2a236d5b91d35c0b1eec066887d33d1a5edaf4f45f72ad12569756e5d941320e1e3606efe9abc23c171b72c19035ab8c34e8

    • C:\Users\Admin\AppData\Local\Temp\DQCEhw.xml

      Filesize

      1KB

      MD5

      c3a2615605491c3c3a5c0abbe3b154e3

      SHA1

      c56180fa03e229c072cd405df90d80ab8de20dfc

      SHA256

      5809d3be52d18018090560068c04d727e80c0cc6940913e1d9c48340c6d56642

      SHA512

      0b10882c958ebea61472d6228705b3b9473925779d8785aeed27788f67fd04407c8f550f57a7979ab20bda3dff4eaecc4e866b863c36ac14678ff50558b71e3f

    • \Users\Admin\AppData\Local\Temp\791b5d254d26c587d6ed6a85ed95c680.exe

      Filesize

      1.5MB

      MD5

      003fd112f6171946f88bf1be24c8e2cf

      SHA1

      26acc6ca8cfefbef6575d0531efcc99a4491b64d

      SHA256

      1a4fb28af4bbe0c60791dc5e5a9c75be7b865e8d956d8b1e6e6b0aecd63cc5bd

      SHA512

      32b6518f5a250b9a55afb16355ea2a827c7b99adef565d33bb9da06c686ad940408d55873076ad27bb8edda572c4dfd37387e6b3a745ae78b544af1c02854382

    • memory/1848-16-0x0000000023270000-0x00000000234CC000-memory.dmp

      Filesize

      2.4MB

    • memory/1848-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1848-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1848-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/1848-3-0x0000000022DD0000-0x0000000022E4E000-memory.dmp

      Filesize

      504KB

    • memory/3044-20-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/3044-21-0x0000000001660000-0x00000000016DE000-memory.dmp

      Filesize

      504KB

    • memory/3044-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/3044-31-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/3044-41-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB