Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 10:07
Behavioral task
behavioral1
Sample
1561bf3b1ba0fa370abc5c2651498d64.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1561bf3b1ba0fa370abc5c2651498d64.exe
Resource
win10v2004-20231215-en
General
-
Target
1561bf3b1ba0fa370abc5c2651498d64.exe
-
Size
1.6MB
-
MD5
1561bf3b1ba0fa370abc5c2651498d64
-
SHA1
a6b8bb86cc655ac4652128e69ba2b4265cc337de
-
SHA256
82947ca70f901c7d16e2d3053826e37ddff8847d21276374de19f542abc80136
-
SHA512
cc5c9db484b1cdfdfe7153253982f0adcde18ff1c57666a8a7facf000ef74a34f16636521730572483c317975f62f3923c663e9f3a40d55d47a6cb04534a1db1
-
SSDEEP
49152:yBeoax+3zbI9bi+DTfcakLz0DpO2ItHo+v1xK3oEe/JLcfgEfdDShcakLz0O:yBRc0o1DTfcakcDpO5I+v1xVnGfgMdDt
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2716 1561bf3b1ba0fa370abc5c2651498d64.exe -
Executes dropped EXE 1 IoCs
pid Process 2716 1561bf3b1ba0fa370abc5c2651498d64.exe -
Loads dropped DLL 1 IoCs
pid Process 2760 1561bf3b1ba0fa370abc5c2651498d64.exe -
resource yara_rule behavioral1/memory/2760-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral1/files/0x000900000001222a-17.dat upx behavioral1/memory/2760-16-0x0000000023060000-0x00000000232BC000-memory.dmp upx behavioral1/files/0x000900000001222a-13.dat upx behavioral1/files/0x000900000001222a-11.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3036 schtasks.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 1561bf3b1ba0fa370abc5c2651498d64.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 1561bf3b1ba0fa370abc5c2651498d64.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f91800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 1561bf3b1ba0fa370abc5c2651498d64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 1561bf3b1ba0fa370abc5c2651498d64.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2760 1561bf3b1ba0fa370abc5c2651498d64.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2760 1561bf3b1ba0fa370abc5c2651498d64.exe 2716 1561bf3b1ba0fa370abc5c2651498d64.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2716 2760 1561bf3b1ba0fa370abc5c2651498d64.exe 30 PID 2760 wrote to memory of 2716 2760 1561bf3b1ba0fa370abc5c2651498d64.exe 30 PID 2760 wrote to memory of 2716 2760 1561bf3b1ba0fa370abc5c2651498d64.exe 30 PID 2760 wrote to memory of 2716 2760 1561bf3b1ba0fa370abc5c2651498d64.exe 30 PID 2716 wrote to memory of 3036 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 31 PID 2716 wrote to memory of 3036 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 31 PID 2716 wrote to memory of 3036 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 31 PID 2716 wrote to memory of 3036 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 31 PID 2716 wrote to memory of 2336 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 33 PID 2716 wrote to memory of 2336 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 33 PID 2716 wrote to memory of 2336 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 33 PID 2716 wrote to memory of 2336 2716 1561bf3b1ba0fa370abc5c2651498d64.exe 33 PID 2336 wrote to memory of 2560 2336 cmd.exe 35 PID 2336 wrote to memory of 2560 2336 cmd.exe 35 PID 2336 wrote to memory of 2560 2336 cmd.exe 35 PID 2336 wrote to memory of 2560 2336 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\1561bf3b1ba0fa370abc5c2651498d64.exe"C:\Users\Admin\AppData\Local\Temp\1561bf3b1ba0fa370abc5c2651498d64.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\1561bf3b1ba0fa370abc5c2651498d64.exeC:\Users\Admin\AppData\Local\Temp\1561bf3b1ba0fa370abc5c2651498d64.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\1561bf3b1ba0fa370abc5c2651498d64.exe" /TN Nnb8kaFf43a4 /F3⤵
- Creates scheduled task(s)
PID:3036
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN Nnb8kaFf43a4 > C:\Users\Admin\AppData\Local\Temp\2c3dIV.xml3⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN Nnb8kaFf43a44⤵PID:2560
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5ad424c677476a6d6bfdda7919040522c
SHA17f8418c8406604cb5c93661e7505d1a281b2ae92
SHA25631a73fe360ad90f5fb750cea300cfc86e3fa2e6215b5b7d89604c7a3ce16eab1
SHA512263301be360b36d791ec2c421698193180670bdce65ecae4248df505b8973a19ff3773166926ce2b0c6213347c6df85e967adaa2c77a46b921c961885596ee19
-
Filesize
1.3MB
MD5bb66c3a5ad0fe6e31bed8efb348fe91c
SHA185d70b6474be7e18358a238ad663947c97277ee2
SHA2567ea87cccf2e725bdb91fd4c8e0feb508f10ed18972c6395c62d2ae494d7212e2
SHA51251d1a3766b07b0fce4636aefa175b58295824c7395527c6c9200732501a9840934eacd33cc113af7a92e5b2504d08bd368c1f2f8125d897f0e1f46d4f3b2d912
-
Filesize
1KB
MD5819957784ec7de1b38b0be683f17b9a3
SHA17a341c9645ef48f8ac078fb9e8c15348b3eb86ff
SHA25658ef937799afaf36d2e7dec6874b2b98745c1060a239fd287d5394fa7a55ce8d
SHA5127ff9c7ad935388292c600a32de8811f1cffb9593a22345dd030c2cfff3c10184a4e77fd6b1455dd22406810a57ca41a2e638e1d7e6eb250809f7d391f431b381
-
Filesize
1.3MB
MD503c2cab42f78993ade4803b28d60edd5
SHA14d8658ebac3a7a2347c17f2175f1884c4869656b
SHA2561284d7afa549aa2376170fcf37845b972c00a1e8c907d8201ddf206dcd205955
SHA51261aff4cee60bb4c4c6a352c74de965c78004dbc6e1d5403a33cf4b6d8f3e30235191d7ff7a7fc9f84bf66e3204cc71a85504c88c49bbf983377e2f3b6f27f6ea