Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 05:01

General

  • Target

    0f63efb5808ad5048cf34c19ac7e42cc.exe

  • Size

    1003KB

  • MD5

    0f63efb5808ad5048cf34c19ac7e42cc

  • SHA1

    63cc20ea941c7d12a10036367c3f0f824b33fa16

  • SHA256

    622f3313d75ae186b90254b755b5248a4874f43be5fe5d709dbebdc9878d4f55

  • SHA512

    241637059782e1c9cc597796e71c965de86ae70ebb05abb4162620e28339ed98b65ae1e49c647e4c3faa050f90959b28e364300d5f20591d0544d5ce1ec8f13c

  • SSDEEP

    24576:mSgxXBfWHN3JaSsD+pxn/9SryFGQoadai7D3uITjIFOxo53ApIj:m/xxfWHN3JaSsDOn/9SryFGQ7ai7D3xW

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f63efb5808ad5048cf34c19ac7e42cc.exe
    "C:\Users\Admin\AppData\Local\Temp\0f63efb5808ad5048cf34c19ac7e42cc.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\0f63efb5808ad5048cf34c19ac7e42cc.exe
      C:\Users\Admin\AppData\Local\Temp\0f63efb5808ad5048cf34c19ac7e42cc.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0f63efb5808ad5048cf34c19ac7e42cc.exe" /TN qm2lmOfce5f6 /F
        3⤵
        • Creates scheduled task(s)
        PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c schtasks.exe /Query /XML /TN qm2lmOfce5f6 > C:\Users\Admin\AppData\Local\Temp\4wXyXmyJ.xml
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2688
  • C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Query /XML /TN qm2lmOfce5f6
    1⤵
      PID:2648

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\0f63efb5808ad5048cf34c19ac7e42cc.exe

      Filesize

      347KB

      MD5

      2234c40c9047be5b072a3bd119afd366

      SHA1

      1d162090375013ef41843115daf1df012733b9a2

      SHA256

      cb49508cd6e724602c10df17c030385acfda1d9754e751254851a8ebd179410a

      SHA512

      a6c71ffaa4b3db11261db142142dbbbeaa6888aa906cb7f9c34b7251f9f9acbdea91d47a270766678f5130e55166bb8f73ba1160adc17611f89317961b416041

    • \Users\Admin\AppData\Local\Temp\0f63efb5808ad5048cf34c19ac7e42cc.exe

      Filesize

      95KB

      MD5

      2abda4eceee5a9864690f18d156ff2e6

      SHA1

      50c8f452d6770da79febce0a00edf5649df9e11c

      SHA256

      3813f243ef6e0744d3f7073de20ba1ff857510b7583c6c18d921163e636a8ecf

      SHA512

      fc6793dcf9af4526f0f960c27255c46f952bda85b1052e9deb9b41e1dfdce36cbe9e030fd74ec1aa61886109ed40abef07ad4687535bb242cbbdaa1fdbd30ed2

    • memory/1768-20-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/1768-22-0x0000000022D90000-0x0000000022E0E000-memory.dmp

      Filesize

      504KB

    • memory/1768-31-0x0000000000470000-0x00000000004DB000-memory.dmp

      Filesize

      428KB

    • memory/1768-26-0x0000000000400000-0x000000000045B000-memory.dmp

      Filesize

      364KB

    • memory/1768-45-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2216-0-0x0000000000400000-0x000000000065C000-memory.dmp

      Filesize

      2.4MB

    • memory/2216-2-0x0000000022E00000-0x0000000022E7E000-memory.dmp

      Filesize

      504KB

    • memory/2216-1-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

    • memory/2216-17-0x0000000022F90000-0x00000000231EC000-memory.dmp

      Filesize

      2.4MB

    • memory/2216-16-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB