Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

24065baedb...00.exe

windows7-x64

7

24065baedb...00.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    142s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 14:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    24065baedb9c3bf7bf0b4123e90a2e00.exe

  • Size

    328KB

  • MD5

    24065baedb9c3bf7bf0b4123e90a2e00

  • SHA1

    67ba28cb7e13ae4134e7feff213cb40cb70a1bbf

  • SHA256

    38ac714aa452ac3aa9fc67be683c04d1acf325694d8bf60208ac179bdd2c99ee

  • SHA512

    d32a9e81002bff57e2a70c19f00009e9833d80db25e35dc1ba289cb246b79281ed702f34d06c749cc24e6abd554ff7cced3c0aa2cbf0b391d58e6f82971e5214

  • SSDEEP

    6144:veXA47CURW+eirtnIwE0XzBTjrBLt4smgZbMfqbTYN8MN5lRFPJje:veXv7tRWwnIKBTjx6smg9M75lRzy

Score
7/10
bootkitpersistenceupx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\24065baedb9c3bf7bf0b4123e90a2e00.exe
    "C:\Users\Admin\AppData\Local\Temp\24065baedb9c3bf7bf0b4123e90a2e00.exe"
    1⤵
    • Enumerates connected drives
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Modifies system certificate store
    PID:2596

Network

  • flag-us
    DNS
    b.liteflames.com
    24065baedb9c3bf7bf0b4123e90a2e00.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
    Response
  • flag-us
    DNS
    b.liteflames.com
    24065baedb9c3bf7bf0b4123e90a2e00.exe
    Remote address:
    8.8.8.8:53
    Request
    b.liteflames.com
    IN A
  • flag-us
    DNS
    csc3-2010-crl.verisign.com
    24065baedb9c3bf7bf0b4123e90a2e00.exe
    Remote address:
    8.8.8.8:53
    Request
    csc3-2010-crl.verisign.com
    IN A
    Response
    csc3-2010-crl.verisign.com
    IN CNAME
    crl-symcprod.digicert.com
    crl-symcprod.digicert.com
    IN CNAME
    crl.edge.digicert.com
    crl.edge.digicert.com
    IN CNAME
    fp2e7a.wpc.2be4.phicdn.net
    fp2e7a.wpc.2be4.phicdn.net
    IN CNAME
    fp2e7a.wpc.phicdn.net
    fp2e7a.wpc.phicdn.net
    IN A
    192.229.221.95
  • flag-us
    GET
    http://csc3-2010-crl.verisign.com/CSC3-2010.crl
    24065baedb9c3bf7bf0b4123e90a2e00.exe
    Remote address:
    192.229.221.95:80
    Request
    GET /CSC3-2010.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: csc3-2010-crl.verisign.com
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Age: 5008
    Cache-Control: public, max-age=3600
    Content-Type: application/pkix-crl
    Date: Thu, 28 Dec 2023 13:14:38 GMT
    Last-Modified: Thu, 28 Dec 2023 11:51:10 GMT
    Server: ECAcc (lhd/35E5)
    X-Cache: HIT
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    X-XSS-Protection: 1; mode=block
    Content-Length: 107635
  • 192.229.221.95:80
    http://csc3-2010-crl.verisign.com/CSC3-2010.crl
    http
    24065baedb9c3bf7bf0b4123e90a2e00.exe
    2.3kB
     111.3kB
     46
    82

    HTTP Request

    GET http://csc3-2010-crl.verisign.com/CSC3-2010.crl

    HTTP Response

    200
  • 8.8.8.8:53
    b.liteflames.com
    dns
    24065baedb9c3bf7bf0b4123e90a2e00.exe
    124 B
     121 B
     2
    1

    DNS Request

    b.liteflames.com

    DNS Request

    b.liteflames.com

  • 8.8.8.8:53
    csc3-2010-crl.verisign.com
    dns
    24065baedb9c3bf7bf0b4123e90a2e00.exe
    72 B
     212 B
     1
    1

    DNS Request

    csc3-2010-crl.verisign.com

    DNS Response

    192.229.221.95

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab4AB8.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar4AEA.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    Download Submit

  • memory/2596-0-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

    Download

  • memory/2596-61-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

    Download

  • memory/2596-67-0x0000000000400000-0x00000000004BC000-memory.dmp

    Filesize

    752KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.