Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 22:16

General

  • Target

    3b336ebbbcf1d7750b00e915968da311.exe

  • Size

    420KB

  • MD5

    3b336ebbbcf1d7750b00e915968da311

  • SHA1

    264a078271f953fbd2a9bd3b0c9916140649670a

  • SHA256

    05e24306eaa5c92981c15d062fa74372c36bd21e4bb3a59c2a32894b88aae7d7

  • SHA512

    a3e331687e88736d1cfb59202c92b0d228f9e2b2dfd070fd2112119877d4cda660f042e67dda2829ef1bb613fe8172503c1eab1f0f0af894fd8b2ef1acbfdb87

  • SSDEEP

    12288:GwaA3t7VPRw+8cOSQN2jyGFyFjISvfsJJa/oSdc:5pbw+8cze/jL4U7c

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b336ebbbcf1d7750b00e915968da311.exe
    "C:\Users\Admin\AppData\Local\Temp\3b336ebbbcf1d7750b00e915968da311.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    667076bb0aac8c7bfcaca9d6fbdb3bf3

    SHA1

    03ba520ef1c274ba6b73f482d8dfd641069d6b74

    SHA256

    afb59a122c1ba586a5ef79fa9db4f008f568b6aa08e94266d99ddc8c35abf0fe

    SHA512

    4d5e8cfedd86bba8d88ea29424b054e41c9c8fba0c6811e736c2bbcd6fde05352fe2a0aaacb977a4e56585ab7ebf14d8ba3cdb22dacc6e3071cf760024e43526

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f3858a9cb2b66403b8ed527da615c065

    SHA1

    21dc41341778dfbb1fac6a7266e2e555dbbe185f

    SHA256

    6b956d2ca881cd75045301f1cbdcd58d7fcf46437449dea8658ffc4437fd3386

    SHA512

    f715d838652ea4263e16e2227935cea918ab70939d61f8cc98afcf5fcba28152b7b51b971359ca41b361803b3cc45926c1baa54cf04378288056b2615b5b3114

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fff86d68c6eff4937d97120f51b4f8d7

    SHA1

    78ec0631b0a6cdbd52f3fd56a998684060666a31

    SHA256

    e26afbcda89d61308e726204033693ccf5c834795a7572853e32699e72de86bd

    SHA512

    0f495a00a857ab0e4784995e5b8447489e46b3b61e855c748ca350e6b8ef6153e7acc0f9f86d8a6616fe2baa86aa841035899302ecfc16c25caa3c327915137e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fb0d5b61a7959f763f0c8f5e6a5dc4a0

    SHA1

    6610e46c51b33f93e9bb8b68222c30cc7e268280

    SHA256

    c3ef8cdceeeabe488f7b7c8b0fd92da0f4973afcbfdce5b1235a2b7cfbe12fd2

    SHA512

    f4b7ea92068b547135ac5dae85b1478dc53fbda3636adf8156a8357fa5355c615a64cedbbd373d0c6b498094a8c8fda210c9a6faa1ae10cbb038af748efd9174

  • C:\Users\Admin\AppData\Local\Temp\Cab1DEE.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar1E01.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Roaming\GetRightToGo\3b336ebbbcf1d7750b00e915968da311.data0

    Filesize

    860B

    MD5

    05b575bb0ff0b44483548f45d98afdab

    SHA1

    ecf12cc8942c831a30d0f6584895781e6390f049

    SHA256

    896e9a344a1ef03bfded7b14d72c3306d1cf726e3fd09c1bfc7035fbb58155d2

    SHA512

    77144dcb4fc243d42121a911290083a48e69164f40d3781673d6856a71433774db15820f04241b22374acd3cd671bd92a63eb3709e3a42fb56b703a55520cbe6

  • C:\Users\Admin\AppData\Roaming\GetRightToGo\3b336ebbbcf1d7750b00e915968da311.htm

    Filesize

    87KB

    MD5

    2290e78ddaffaa73838e9a67d679cbc7

    SHA1

    5e2583a2c5bad107c82cab2a495d559e1385ae41

    SHA256

    ca6005b88259d61bfc9943b1236cd4f6f12833f3134a3c1553545247d95aca2d

    SHA512

    a2c6ae503b264e30925c685efb6389175138fb809989d5e4c61e62345662c0d7a6e0de57c6a8f883209c7bf613c6be3fb4ca2031876d562271c8b111ad338abc

  • memory/2692-0-0x0000000000400000-0x0000000000602000-memory.dmp

    Filesize

    2.0MB

  • memory/2692-174-0x0000000000400000-0x0000000000602000-memory.dmp

    Filesize

    2.0MB