Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 15:46

General

  • Target

    e013693afdce118675f96f00bad62d83.exe

  • Size

    133KB

  • MD5

    e013693afdce118675f96f00bad62d83

  • SHA1

    3ede49ba89e8f6baa86a7eb463156433caf4b129

  • SHA256

    b94ec3ed7a9ba11cd4e3d020f1b38e30f818dc91bde151ea81f2a0a28a2ee754

  • SHA512

    31b73e2ef36610e7e32d51f9afeae4a6ef1b3df0db62c7868efbfe17dd8f963620055920f7df106a1926b5f086fc73750610915f58305c0c95a4ba121a8a8a54

  • SSDEEP

    3072:Hn1uP6TNNOKaCaY01EKPKVYjk/+uVdh3V29M9HnJXi4wk3Ix1Q:VmmNZaf1bPKqjtkdhl2G9HFwZx1Q

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe
    "C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe
      C:\Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2996

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\e013693afdce118675f96f00bad62d83.exe

    Filesize

    133KB

    MD5

    27aa6e5f688f22af45d113f6bbe6eafc

    SHA1

    0982de33b2fcdda71c5b2d1deb7b2b2cfae71fc6

    SHA256

    e8800e84789183501d65d1acb4353dcd3857375da18ddc51ac9a3dbffdb1d213

    SHA512

    6d3d68b0ef4d9208a4e562909c0fc334f40eec0fe5a6ea42e99e19be42bd39bb8ab5ecfd1aa8ccaacfc187af0c318d48fc4796f1444588b03bf51370b9468cc8

  • memory/2156-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2156-1-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2156-10-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2156-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2156-14-0x0000000001490000-0x0000000001516000-memory.dmp

    Filesize

    536KB

  • memory/2996-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2996-20-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2996-34-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB