Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 20:37

General

  • Target

    3bc6d968dc7bf14b22faacda814e78fe.exe

  • Size

    472KB

  • MD5

    3bc6d968dc7bf14b22faacda814e78fe

  • SHA1

    8809369e2f4c37939bc149128dae61295ebaefc1

  • SHA256

    ac6e48c417f264463f08dac5c61f25855c56716e46d98c07eff2b6afba370e07

  • SHA512

    3167cbf457f3eb9316a86fdeeb019e2a61cfb3f00bb7891273899763e1c3ee7f57f36b23762f28fbc9daf53f58e44efbb8226a80a978b6ba8f2646753bf0cc56

  • SSDEEP

    12288:3o0KQFr0jLiqUkwwarlSERGlkZW+qlV03Ps0M:3oNQFr2+qUJZrlt2kZW+D9

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\3bc6d968dc7bf14b22faacda814e78fe.exe" /TN QxutJGth3fd4 /F
    1⤵
    • Creates scheduled task(s)
    PID:2824
  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Query /XML /TN QxutJGth3fd4
    1⤵
      PID:2112
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c schtasks.exe /Query /XML /TN QxutJGth3fd4 > C:\Users\Admin\AppData\Local\Temp\eLAjvKq2O.xml
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2808
    • C:\Users\Admin\AppData\Local\Temp\3bc6d968dc7bf14b22faacda814e78fe.exe
      C:\Users\Admin\AppData\Local\Temp\3bc6d968dc7bf14b22faacda814e78fe.exe
      1⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1812
    • C:\Users\Admin\AppData\Local\Temp\3bc6d968dc7bf14b22faacda814e78fe.exe
      "C:\Users\Admin\AppData\Local\Temp\3bc6d968dc7bf14b22faacda814e78fe.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: RenamesItself
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2224

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\3bc6d968dc7bf14b22faacda814e78fe.exe

      Filesize

      92KB

      MD5

      f4463ae4d96295f56615f2794a84c014

      SHA1

      c68176eef536b16c2e372e792816926b61bd4af3

      SHA256

      472b5536025e39915d6222fc6cad655bf9ac62e4365aabfe06d6e6d394d8012e

      SHA512

      de8d079c40ff3b53eb9dcb9cfb0bfcc108a6c5f62f2a1333daf4a4af8bf549b492ebebec0794c253e2b45062ccd44c19a0bd297ed160bb39f08680cca24958a8

    • memory/1812-31-0x0000000000470000-0x00000000004D6000-memory.dmp

      Filesize

      408KB

    • memory/1812-20-0x0000000000400000-0x00000000005DA000-memory.dmp

      Filesize

      1.9MB

    • memory/1812-26-0x0000000000400000-0x0000000000457000-memory.dmp

      Filesize

      348KB

    • memory/1812-22-0x0000000000200000-0x0000000000276000-memory.dmp

      Filesize

      472KB

    • memory/1812-37-0x0000000000400000-0x00000000005DA000-memory.dmp

      Filesize

      1.9MB

    • memory/2224-18-0x0000000002D00000-0x0000000002EDA000-memory.dmp

      Filesize

      1.9MB

    • memory/2224-1-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

    • memory/2224-16-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

    • memory/2224-2-0x0000000000300000-0x0000000000376000-memory.dmp

      Filesize

      472KB

    • memory/2224-0-0x0000000000400000-0x00000000005DA000-memory.dmp

      Filesize

      1.9MB

    • memory/2224-36-0x0000000002D00000-0x0000000002EDA000-memory.dmp

      Filesize

      1.9MB