Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 03:13

General

  • Target

    0ca27de60496bbe5ee9a65a5d3c99584.exe

  • Size

    133KB

  • MD5

    0ca27de60496bbe5ee9a65a5d3c99584

  • SHA1

    fe333cdcaaff82b74534df52645a3c3231bbcd5e

  • SHA256

    8682dd2b3dadc843bf3c6054872e4d29ed0ec1fc56e931b4f3128e8972375cc5

  • SHA512

    9fb6f5ba502cbf0d1699cc4deef0f7f999ce1cc04fdeed32c5094dca9d0f739d2001a1b637331527be86c928236ca9434b7e5b2c9eb119e565c323d65cb4eaef

  • SSDEEP

    3072:7SG+cx8AxvOmO9XP09UFJrZnlv5GoCGPoDZm39GXypwQ:mX884OmSc9U1F5GoTPuK9HpwQ

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ca27de60496bbe5ee9a65a5d3c99584.exe
    "C:\Users\Admin\AppData\Local\Temp\0ca27de60496bbe5ee9a65a5d3c99584.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Users\Admin\AppData\Local\Temp\0ca27de60496bbe5ee9a65a5d3c99584.exe
      C:\Users\Admin\AppData\Local\Temp\0ca27de60496bbe5ee9a65a5d3c99584.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0ca27de60496bbe5ee9a65a5d3c99584.exe

    Filesize

    105KB

    MD5

    4f83bff6b009836b737e208980257440

    SHA1

    2e47c715e64e1d30f1cef4a76a734c715c27d681

    SHA256

    4dc36c65ce190f40ce3ad5ef3c2b4cc969725a003f73c5cc5ff3d958c2528ba7

    SHA512

    378003f18d10068194970a613c4708c6e30fd3799bb02ead0c3892e357daef04586e1be910ec0a28d03e1227368ab6c3bdce723364ebe6386d84ca2b3e17d5a3

  • \Users\Admin\AppData\Local\Temp\0ca27de60496bbe5ee9a65a5d3c99584.exe

    Filesize

    133KB

    MD5

    7797d6fe7c13b06e4c91da505224411a

    SHA1

    422a6c69f768ffc8a4f05ae3637b25e4067ba1a5

    SHA256

    6043313a968a17f63542d52b65771886b6e6f373eabd3ad83be94b1a6aecffec

    SHA512

    03aa707350a1598e7220e9065ecb6c24068c3f5916bbbaf254e3237b3ab3701e23043fbad90e324531d54846b86b90d33caad3d716d7f21c60dc07584a79efd3

  • memory/2184-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2184-2-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2184-1-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2184-15-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2184-14-0x0000000001490000-0x0000000001516000-memory.dmp

    Filesize

    536KB

  • memory/2852-18-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2852-20-0x0000000000150000-0x0000000000171000-memory.dmp

    Filesize

    132KB

  • memory/2852-43-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB