Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
3f0fb4fa09d64d152e2c345152f668ed.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3f0fb4fa09d64d152e2c345152f668ed.exe
Resource
win10v2004-20231215-en
General
-
Target
3f0fb4fa09d64d152e2c345152f668ed.exe
-
Size
759KB
-
MD5
3f0fb4fa09d64d152e2c345152f668ed
-
SHA1
b54396c192ef69372fd1d6f9bf1a4b3dbf3d9a41
-
SHA256
24aad9c501f96eee3604ab467e710703168125d0b69ba618e63bd4f2ec46c552
-
SHA512
d21fa9402b1cd332c0a91de64a9f92dd09523128ff7a7fdeae728bc77a6ed0e46250445934d66f5d2b4fc1337139d1d8d7d0c69a7e97f830b1214d59c3960364
-
SSDEEP
12288:Np4xDfr5AsTKV4gZMjHkU+aNiRqtvQ9N0gYzj9+TAYrUaGRrBNvEuAgVaRdLuVsP:NpIDPTY48Mr5wqt48gYxmUas1NvEuAgE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2072 setup.exe -
Loads dropped DLL 1 IoCs
pid Process 2908 3f0fb4fa09d64d152e2c345152f668ed.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 setup.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 2072 setup.exe 2072 setup.exe 2072 setup.exe 2072 setup.exe 2072 setup.exe 2072 setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2072 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 17 PID 2908 wrote to memory of 2072 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 17 PID 2908 wrote to memory of 2072 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 17 PID 2908 wrote to memory of 2072 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 17 PID 2908 wrote to memory of 2072 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 17 PID 2908 wrote to memory of 2072 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 17 PID 2908 wrote to memory of 2072 2908 3f0fb4fa09d64d152e2c345152f668ed.exe 17
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f0fb4fa09d64d152e2c345152f668ed.exe"C:\Users\Admin\AppData\Local\Temp\3f0fb4fa09d64d152e2c345152f668ed.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD55b1693f71ff0e6b99b8912c4a41692ba
SHA10572a7b765ffe7e478dba0ec8963672e3410c5cb
SHA256f0d8fe781ec4214ff5528c55d689f4925b7efd57e203923a5bc3fd283c28d150
SHA512c972122ba83d4932939113f81f96aabeae090b9cd98cc098dd09b8e95413d59df357f4b126fe6a483fca805d4f296fad11451d22f16148c5590320741381aade
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
85KB
MD539a86ee0b5cf90f64e836999eb758845
SHA167c90686a97305b59144c2699a0dfe32f7e419d0
SHA256f6198c383204f5594bb9cb9d2b17c5df53fffe6c81d742e19186ccfa0e0cc2fa
SHA512e34202980b4f8c50d4469e8aff3ed3504a14d1fdc40ad909277a544c0083b5e472019c6baeb3eda94c57ab7c7a8bbd477c49983a793444b1b645c712617b7289
-
Filesize
32KB
MD5e953192a01b8434f6984d5463687f976
SHA1d68572e644d996779088120c230c916d359cf794
SHA2562580886bdfcdeed2f07de511e7b23ecbde83c1cd1903561d5603a4b0b2c347df
SHA512563bfc99ece6e9318fcd6b477ee4d1a56720c1cbcdef71fed104afb24178da31031684696ddc6cdfb23b58650ca563af867b0b3b134b9c7615f32a563e9d74b1
-
Filesize
55KB
MD562f60427e84dff60e7b686a668778419
SHA149d1926f10f1036a3608bc5ff92720f9b8ce4e59
SHA256a8a86885934591186834561688ed4dadd5712e4c6df8063c8f7a6883c6531b75
SHA5125b93d1c5e93fdf703a4e91bc5955ea5b7f113c953268fe05070940788867781ab1eb99718cb9d7d0dce5546cb829b58a6383a4d5fb58afa8c8e4010339ef40a6
-
Filesize
9KB
MD5daa76ada8acfc17727ec30c1ef3aa9b5
SHA1ff41ac06457b67a405c06e1048652ec016aa2742
SHA2566ddcfb57d5fb9c5d1193d306d8d2aeae5bb43a66f13eb95bb2f8dcb229cba975
SHA5128981025f4df80589e892cf177eed50be404080803c107a3797563dfcb14ac5c02df6a612b17a8b486d23294ccca61ba7ee3bafc93202596a18bfaee56195578b