Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 00:12

General

  • Target

    081ed7416b96c96559ab345630cc62c5.exe

  • Size

    302KB

  • MD5

    081ed7416b96c96559ab345630cc62c5

  • SHA1

    e52ee9fd04f840ec2f539256769871c929264030

  • SHA256

    397fa2887836dd57faf84524c251d19598060f0be0a5e02bc6c52ba2ab711c0a

  • SHA512

    80a27483a11a6d5cef13296f5b92372e7184d71f9b7c80acef3ebfa3b97d3c967d4e56c099ff429c4c71b8e46c564368ecb614759be357e669bc9dc97707ccf0

  • SSDEEP

    6144:uZU5jZggfOO7uC28ylSiY0rv4iN1G8IejnY65mQ:uGjZHmkfVi1rv4iN/YYm

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\081ed7416b96c96559ab345630cc62c5.exe
    "C:\Users\Admin\AppData\Local\Temp\081ed7416b96c96559ab345630cc62c5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\081ed7416b96c96559ab345630cc62c5.exe
      C:\Users\Admin\AppData\Local\Temp\081ed7416b96c96559ab345630cc62c5.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2360

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\081ed7416b96c96559ab345630cc62c5.exe

    Filesize

    203KB

    MD5

    94f0a6b6b77a345284cb4a3b05be5333

    SHA1

    d50836a52ab801ebb6c2b7b6eaf5fe292ad425d8

    SHA256

    23413a73a12cd37a5b2903c7f09449f2739a5beb885bf202b96ffc813852b378

    SHA512

    286d57885b4bbed768fad83713210f71397a04c328449ba5509ae53d20cb6fd62202fb397b563be95362b4ae835c69ae5e7322da0735546ba9eaf25f36176a21

  • C:\Users\Admin\AppData\Local\Temp\081ed7416b96c96559ab345630cc62c5.exe

    Filesize

    221KB

    MD5

    c38e20cb1e3583aae6617a9f6cd434b5

    SHA1

    1f5d8cedb00ff8a5c7825a545d85ea4503d59582

    SHA256

    da176bad72dd2efeb12b369d8aeee98f9321b71605b748a88bc30d57d91205b0

    SHA512

    9d83c920f015d8db1429df6dfd1aaf5144af1877d903a26b2c6937b1c99806bfc79a53d6bbf74bbbe58c4f83f915a55a5f6cbb22bdb60ec3c8c09f8182b3f980

  • \Users\Admin\AppData\Local\Temp\081ed7416b96c96559ab345630cc62c5.exe

    Filesize

    278KB

    MD5

    f8133fb21cd717d107ebb653d5d6b0f7

    SHA1

    b730e9619306a1be3d6aac41b556cf54be80fe08

    SHA256

    f52b2a224f9a768e381ae830cf80731d78d633fad8cdaf8138018d09250714a7

    SHA512

    7b080928a8d57026a607360e47e2bff4101b6f230329676bddd6941363c6da98b92dd3d57428d31d4d284ad73a4c072f0f135c1b35b32f063840b915b88b4efe

  • memory/2360-20-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/2360-22-0x0000000000200000-0x0000000000231000-memory.dmp

    Filesize

    196KB

  • memory/2360-45-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/3048-0-0x0000000000400000-0x00000000004E0000-memory.dmp

    Filesize

    896KB

  • memory/3048-2-0x0000000000300000-0x0000000000331000-memory.dmp

    Filesize

    196KB

  • memory/3048-1-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/3048-16-0x0000000022D60000-0x0000000022E40000-memory.dmp

    Filesize

    896KB

  • memory/3048-15-0x0000000000400000-0x000000000043E000-memory.dmp

    Filesize

    248KB

  • memory/3048-44-0x0000000022D60000-0x0000000022E40000-memory.dmp

    Filesize

    896KB