Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    175s
  • max time network
    184s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 20:12

General

  • Target

    02ae8736611d3bccc120e3579bdd76df.exe

  • Size

    501KB

  • MD5

    02ae8736611d3bccc120e3579bdd76df

  • SHA1

    1048439bd12d6837aafd04fb61efbb5d766fb8b1

  • SHA256

    4a5e747ae28948df4bf3c7fa2d249c0f8dd39dfdde9a733b69ae6a6ad383f2c2

  • SHA512

    69ce18d017e7e26fded9212a03cc5a03a5bbb12a1175ea479336d85ada6e0f485cf6ba877d182fcd373fce73fdf30b7a73c2578b1cfd45cdeaae2ac7c1252aa8

  • SSDEEP

    12288:wkAOVOhk1KsO+z+fVI1iGTfuMV6I9k9h8bIC:w82sHSfsi2V6Ia9h8bx

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe
    "C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe
      C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe" /TN MXmKXYLpa01b /F
        3⤵
        • Creates scheduled task(s)
        PID:2692
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN MXmKXYLpa01b > C:\Users\Admin\AppData\Local\Temp\CD5zt.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2628
  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Query /XML /TN MXmKXYLpa01b
    1⤵
      PID:2268

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe

      Filesize

      144KB

      MD5

      36d570775f782ad00b06243161be60f2

      SHA1

      ee46f0632a2e3f4fd8267d663cfd6047838a4443

      SHA256

      8f70fe0159e1d436965a93892ace2626c6af2db617245b6b6fc40bdd2a12054d

      SHA512

      385be7089d7560712f76366e2f8db4f866f1a300f566407c8944ebed854a1a90bdbd9947817515602eadb297bcff533e9e37e31eb0d9ebccaf41eb10678094df

    • C:\Users\Admin\AppData\Local\Temp\CD5zt.xml

      Filesize

      1KB

      MD5

      a643378e7cbcafb2184192b1056aba34

      SHA1

      076b621d6c06a5cde7f10e9c5813a594c2a8f835

      SHA256

      81193d8b8e1f2b390c9fb75e1c2f4cd6d8439019797e07d2aad6673a87a727f6

      SHA512

      f8b9b588b1987cb6395d00bb0437fd461a70f9298d436475a3af8c55de8abe4258f89284da9edde8f289b0ef972f0a5f40e4b468db0b5b6cc2e2e176db91bc94

    • \Users\Admin\AppData\Local\Temp\02ae8736611d3bccc120e3579bdd76df.exe

      Filesize

      188KB

      MD5

      6ea49c11055c15b3ad1399bf049d69dc

      SHA1

      2519654a78ba47255d4f568e09d18a6acbeff9b1

      SHA256

      d7fba4d1e432c5a20e7265580f442a7e72a80e4533ade0195a7a60567b49dcab

      SHA512

      1f6139bb7a9c0a274b0d5ace70b92cd6c66821c3cecdffe2bba54b804dda3ecfc36a1c7b7481a2c5eaa50cdb266974463233e2dc67cc35c66d42762bb9431726

    • memory/2776-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2776-4-0x0000000000330000-0x00000000003AE000-memory.dmp

      Filesize

      504KB

    • memory/2776-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2776-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2776-17-0x0000000022F00000-0x000000002315C000-memory.dmp

      Filesize

      2.4MB

    • memory/2976-18-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2976-31-0x0000000000320000-0x000000000038B000-memory.dmp

      Filesize

      428KB

    • memory/2976-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2976-20-0x0000000000240000-0x00000000002BE000-memory.dmp

      Filesize

      504KB

    • memory/2976-53-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB