Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 06:26

General

  • Target

    2bacd72d504db350681060725fad3889.exe

  • Size

    133KB

  • MD5

    2bacd72d504db350681060725fad3889

  • SHA1

    79e1d59ba26aaec0532c07c79ffc8344f5381816

  • SHA256

    2ac000cf58ceb9ce8f770e5f1c0f9361ef75d360b795fdd996441a3cf586c620

  • SHA512

    87f10818144d9f68d5be6a7bb8da8aca61b757e2afda2fcb72636670258d8ae3999242e15845b70a050f80bd013b046b50eea68091b7585082b4ed9393777e97

  • SSDEEP

    3072:SQU3J6ZfGQ+qFECfz/OrBNlg0FM5RhlsLTC1qV8CDlrY4MfIkKENaAQ:SQmJ6NGjqtz2rBNK0ODQLO8V8CJY45k+

Score
7/10
upx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2bacd72d504db350681060725fad3889.exe
    "C:\Users\Admin\AppData\Local\Temp\2bacd72d504db350681060725fad3889.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2720
    • C:\Users\Admin\AppData\Local\Temp\2bacd72d504db350681060725fad3889.exe
      C:\Users\Admin\AppData\Local\Temp\2bacd72d504db350681060725fad3889.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\2bacd72d504db350681060725fad3889.exe

    Filesize

    133KB

    MD5

    923b9b894e68c355127bb4649e5eeb0d

    SHA1

    a5aaa8d2ff0b6d977294c6d821a99cea7c2c32eb

    SHA256

    79fb1eeb44ad7e9671c49cf0a7e43ea35a3778f597d0ac1b68b8158b0cc49775

    SHA512

    296680dd016dd9cc91f4298b283cce4533cf0634f511b5e6aedfa3f6acae012e53e6f04685b5997f2333c58ac85a5c962fbfcd91f532628b87055396e7f47c52

  • memory/2720-0-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2720-2-0x00000000000E0000-0x0000000000101000-memory.dmp

    Filesize

    132KB

  • memory/2720-1-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2720-15-0x0000000000350000-0x00000000003D6000-memory.dmp

    Filesize

    536KB

  • memory/2720-14-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/2772-17-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB

  • memory/2772-20-0x0000000000180000-0x00000000001A1000-memory.dmp

    Filesize

    132KB

  • memory/2772-43-0x0000000000400000-0x0000000000486000-memory.dmp

    Filesize

    536KB