Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 23:33

General

  • Target

    2025b9e26267efead64f719a14f37633.exe

  • Size

    2.0MB

  • MD5

    2025b9e26267efead64f719a14f37633

  • SHA1

    b7f117b1fd51f8fdd74c62a4b5e9c2f1537795f9

  • SHA256

    c6b00db4ce342ff378bd8c1ccd7acb607246d334d645bdaa64887407d1094d4c

  • SHA512

    76ec3d7b2704326bdfe44333307cc693f95de84898672b6704532f0d5fd26f7169510dc9df39799d4d36d20f8d1d4298a2cf919f0acc9d309d527c53f25b6cd0

  • SSDEEP

    49152:eXK1ZbPTNuum+cN+9zWFULG+0dKS24DpVUcN+9zWFULG+:9zduumnA9zyULG+0dKz4DpvA9zyULG+

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe
    "C:\Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2172
    • C:\Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe
      C:\Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:2384
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe" /TN U5Z8sQiHf24d /F
        3⤵
        • Creates scheduled task(s)
        PID:2904
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN U5Z8sQiHf24d > C:\Users\Admin\AppData\Local\Temp\jKnMIdn2A.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2752
  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Query /XML /TN U5Z8sQiHf24d
    1⤵
      PID:2916

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe

      Filesize

      102KB

      MD5

      715c7acba1db3c78331164aebc11c4ae

      SHA1

      add66aa4681d051782d52c0e6ff459d3f479de64

      SHA256

      99f1837dc33dd9a70dcec7cf1ddbfef67f7e834e85a268f702dcaddc8052bd64

      SHA512

      1b3f41eaf48c338552752c153d7c8b48b60f71f28f2697837d5678ad05ec8ddc8071b809fc7fd05d73e29698ad82274068839c96edfe9cceca0c45c1e3a7bc6b

    • C:\Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe

      Filesize

      381KB

      MD5

      ed0358a176b7ddb4bcde203b1e44f251

      SHA1

      cf627f8cc632df70a3031f0a767b83cef50c3260

      SHA256

      a5cf48ee1a3d223e6088ef9af622139b69cbc1a52095be2de8a951b3777562a8

      SHA512

      97195633bf286813e15b01dbbdbe16e66d3d6f4c5f3749423f38ea7fda9b63d178c21755e3097e6969abb4b4ea80626726fc0ef616042a7c9504a1f8d47c9b52

    • \Users\Admin\AppData\Local\Temp\2025b9e26267efead64f719a14f37633.exe

      Filesize

      769KB

      MD5

      b2be87d88d2b0407548af765b615e3f4

      SHA1

      9395a8972bf906cc8f0930db532eed0096da2b73

      SHA256

      602e7694e918aa150d95c2a7ca89c4f5e11ee6a747cabb80bd16544b2b10a6ba

      SHA512

      5e6305e6fc79c9bf751b377f639b78c7d57eccfa2e97fcea531e95b0e02a7c3112c1121b7752ba7ecd202442b286f39e9088f1f47a4189a9b8e536b2582c1127

    • memory/2172-16-0x0000000023230000-0x000000002348C000-memory.dmp

      Filesize

      2.4MB

    • memory/2172-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2172-6-0x0000000022D90000-0x0000000022E0E000-memory.dmp

      Filesize

      504KB

    • memory/2172-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2172-15-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2384-20-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2384-21-0x0000000000330000-0x00000000003AE000-memory.dmp

      Filesize

      504KB

    • memory/2384-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/2384-31-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/2384-53-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB