Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    9s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 10:21

General

  • Target

    15bf0db8df64ffcfc1868540f5c715fe.exe

  • Size

    2.6MB

  • MD5

    15bf0db8df64ffcfc1868540f5c715fe

  • SHA1

    3edefc8d0a8a93fa9fe6741a0b29f44c7831bd82

  • SHA256

    f0a0a6604bc590de70dc86cc3f57aa2632a13ecc441524dbd76f663dc1f118c9

  • SHA512

    9349aeffd3e3b107777f7553746d550258f8acf3dcc96b5a47787b6a930aef22ddbcb41b4318b27ceaba9322ec46c6991aede617041d4085abf863d3c8944953

  • SSDEEP

    49152:QAOw99yMgGm0MVitNSe7+1GkhxBBMVM/AMcBay3:QG/JZeGtKy3

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15bf0db8df64ffcfc1868540f5c715fe.exe
    "C:\Users\Admin\AppData\Local\Temp\15bf0db8df64ffcfc1868540f5c715fe.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\15bf0db8df64ffcfc1868540f5c715fe.exe
      C:\Users\Admin\AppData\Local\Temp\15bf0db8df64ffcfc1868540f5c715fe.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\15bf0db8df64ffcfc1868540f5c715fe.exe

    Filesize

    1.0MB

    MD5

    5fb53ff168e69e6b176486e652bc9036

    SHA1

    6a9ec840ff0c76c90e64301097e89d925b40571b

    SHA256

    cc03eb3a97bca40c017e7cf6b1b51eced4a13ebebfb5e73f75a3bd3c90bfc856

    SHA512

    04609631793441f74a4b5a971bc33a0de2ff17a5bc4f68537202d6677de59c93ace18214a81fb9263ccd3fb0e188c7fc1a38cda95734b4ed097e7ba29b0dd67b

  • \Users\Admin\AppData\Local\Temp\15bf0db8df64ffcfc1868540f5c715fe.exe

    Filesize

    1.1MB

    MD5

    8430af4a51f47e70ffa05a3e106a23f7

    SHA1

    6a2eb2733ee63479a75d6a8b0969bef3edc05d5e

    SHA256

    c3be3e5149567f9e568e976adbf16ac6470a614adba0217e59b1091cb57816fa

    SHA512

    08b816eb4219a3334a82714c586e2c8f3044929353773623f2c60f72e4c06d610002c4e68edac7e4e7331ed1a9bcd0986d5fafb302b058333aef3c40858d57e1

  • memory/1988-0-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/1988-1-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-2-0x0000000002280000-0x00000000024DA000-memory.dmp

    Filesize

    2.4MB

  • memory/1988-15-0x0000000000400000-0x0000000000605000-memory.dmp

    Filesize

    2.0MB

  • memory/1988-16-0x0000000003B80000-0x000000000451E000-memory.dmp

    Filesize

    9.6MB

  • memory/2260-19-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB

  • memory/2260-21-0x0000000001FA0000-0x00000000021FA000-memory.dmp

    Filesize

    2.4MB

  • memory/2260-39-0x0000000000400000-0x0000000000D9E000-memory.dmp

    Filesize

    9.6MB