Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:10
Behavioral task
behavioral1
Sample
0c8eba1d7455a34444a8d4220ced4658.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c8eba1d7455a34444a8d4220ced4658.exe
Resource
win10v2004-20231222-en
General
-
Target
0c8eba1d7455a34444a8d4220ced4658.exe
-
Size
2.6MB
-
MD5
0c8eba1d7455a34444a8d4220ced4658
-
SHA1
8a5cd139c2fed99792b56274e323df839a81be03
-
SHA256
ff950cbd3a415dac5562a43931de7f641457764c8f35aec39f4181eac9e1e05e
-
SHA512
9dcf11afe148beecc5013a4b81504bca01956e867821a0597447835b80702aca338082e91369966c4eaeaffa27c899899d908a2b90d6f6b5344c04416ae09b9a
-
SSDEEP
49152:IAsmsLB1VA6U4P9+0b1tEmdvmH2gc/ZLr0yK6hX0Su78aay3:WdBP97kvcFr0hckS63
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2740 0c8eba1d7455a34444a8d4220ced4658.exe -
Executes dropped EXE 1 IoCs
pid Process 2740 0c8eba1d7455a34444a8d4220ced4658.exe -
Loads dropped DLL 1 IoCs
pid Process 1636 0c8eba1d7455a34444a8d4220ced4658.exe -
resource yara_rule behavioral1/memory/1636-1-0x0000000000400000-0x0000000000D9E000-memory.dmp upx behavioral1/files/0x0009000000012232-13.dat upx behavioral1/files/0x0009000000012232-11.dat upx behavioral1/memory/2740-15-0x0000000000400000-0x0000000000D9E000-memory.dmp upx behavioral1/files/0x0009000000012232-14.dat upx -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 0c8eba1d7455a34444a8d4220ced4658.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 0c8eba1d7455a34444a8d4220ced4658.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 0c8eba1d7455a34444a8d4220ced4658.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 0c8eba1d7455a34444a8d4220ced4658.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1636 0c8eba1d7455a34444a8d4220ced4658.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1636 0c8eba1d7455a34444a8d4220ced4658.exe 2740 0c8eba1d7455a34444a8d4220ced4658.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2740 1636 0c8eba1d7455a34444a8d4220ced4658.exe 28 PID 1636 wrote to memory of 2740 1636 0c8eba1d7455a34444a8d4220ced4658.exe 28 PID 1636 wrote to memory of 2740 1636 0c8eba1d7455a34444a8d4220ced4658.exe 28 PID 1636 wrote to memory of 2740 1636 0c8eba1d7455a34444a8d4220ced4658.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c8eba1d7455a34444a8d4220ced4658.exe"C:\Users\Admin\AppData\Local\Temp\0c8eba1d7455a34444a8d4220ced4658.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\0c8eba1d7455a34444a8d4220ced4658.exeC:\Users\Admin\AppData\Local\Temp\0c8eba1d7455a34444a8d4220ced4658.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
MD5b565017c0782e565de3cfe9bc34069c3
SHA1bfbd15dfaba79b6263a1848b33fe221b3ae5296c
SHA256e99b4a4be1edf8afb71ca85482f50d4bfb590c8b96a7e0558be113cc9e6f959d
SHA512c476b751d0fd9599b8e539a9efd9bc680c6427ecf728926e48917253bebbf82b7a277d9f74e5fc82ba39ba5cffddb49d50e8d5559a8f9dfb36514c316bc38e5e
-
Filesize
2.6MB
MD54b20a899e232443cdc06716e97bfde61
SHA1de889fee4b9c740100d16006faaa3c5497093b05
SHA256bfb9919aa2a4cf9188eff05deeddd1836066fc1941907ed5349f3ba6d031ae31
SHA51266f2aaa60792395ff23faa94b3803ec4a95696525a261ca38082ad2f9d4c43c810022763209b3ceba3afb4f44bbcd6a71b820ea2dc53484727e92227f5c47954
-
Filesize
1.2MB
MD576ed2ef76130962016af80697ad4979b
SHA1b2c6edef8c9631497ddca3f18b9de26395bd3dbb
SHA25673d5060dc7fed88b0fd44d1023b77fb915d7e3010582ffa9352b1fe0963e05ee
SHA5126d0b201c3fa2835a905f1874bff118d2f69387ce6aa9c66dee7cb02f99d6ed514eaa9743ac005926317f59ecafebc14d7c3e4d2c54fdb3ab4d508d9005e1b4ae