Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2023, 15:12

General

  • Target

    d45da87e194c73eb5e17150c5b95123d.exe

  • Size

    133KB

  • MD5

    d45da87e194c73eb5e17150c5b95123d

  • SHA1

    7eb8c620e00f945bd3f84eabd6a7c07a329a1598

  • SHA256

    65ee62bdf6cb3613cc7a2f7071931ceb3fea20db6ed79c6f1c4ebf084ea6ee3b

  • SHA512

    4535e7eb20e49c5ee2c192f1d7742c4566e2280cc2d840b98951c0134eb24a880c1768a0a43ff4dc4dd78f9382d74a1b58888c359c991fee77561401823e8107

  • SSDEEP

    3072:GUPkdsSYEqEg44WpGSqKHhZC+NB/hTj35jMlHoONgGsQ:GPs9EqE14WpGN6l/h/GlIssQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d45da87e194c73eb5e17150c5b95123d.exe
    C:\Users\Admin\AppData\Local\Temp\d45da87e194c73eb5e17150c5b95123d.exe
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Modifies system certificate store
    • Suspicious use of UnmapMainImage
    PID:3016
  • C:\Users\Admin\AppData\Local\Temp\d45da87e194c73eb5e17150c5b95123d.exe
    "C:\Users\Admin\AppData\Local\Temp\d45da87e194c73eb5e17150c5b95123d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2208

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\d45da87e194c73eb5e17150c5b95123d.exe

    Filesize

    93KB

    MD5

    10f7d2a3cc5aacf96a829386fb2ebc9a

    SHA1

    65bdd87bee72259998abc12267d693d0af39b801

    SHA256

    b807dfef6dd6a3404730c2c9563873609f3768e3949b74188cfbb629d1170c13

    SHA512

    4a1de86b82c7ac204907d2db3766978b9d1d5743e35f949e4689c4ffc47e120cd372da032b1a68c3b2cf3793d77ba52eb664ab8b683f44a1da7a0e52bb0ba313

  • \Users\Admin\AppData\Local\Temp\d45da87e194c73eb5e17150c5b95123d.exe

    Filesize

    133KB

    MD5

    e55dbeb49ca4f7de4a26d832721d4bf9

    SHA1

    24135b84231a3c5eb048ddda8c66620a797614e2

    SHA256

    a9ea05b340061ecbd55344a6ac61a943ced61a5eb1fdd339bdfef3079e8ee0bb

    SHA512

    cd9fc683a161db7add56b8218571e3a230e0ed9e12b2c3bce4761b02f45c6883058ce8563a0b3df05bc7c93d105935287849ea8fdcaa0a7d08f0f6a3452126c4

  • memory/2208-1-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2208-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2208-3-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2208-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/3016-17-0x00000000000E0000-0x0000000000101000-memory.dmp

    Filesize

    132KB

  • memory/3016-20-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/3016-33-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB