Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31/12/2023, 07:26

General

  • Target

    2d561cebf83d31275c393a46ba73fa23.exe

  • Size

    385KB

  • MD5

    2d561cebf83d31275c393a46ba73fa23

  • SHA1

    9a4b42656341608038adead1f7ed1222ffee200b

  • SHA256

    54598c5b0693db9e76cf7a2ac5c5b79ff553fb9e3d389e02d1337459d9d8f63a

  • SHA512

    d3b66f69a312d1a223cbce435b301cd9cee488b4b2bbe55d52d1934090ec2ec66db85875efe49a908d926e5adc39f89a6d9e79fe4f88216caaf0b2bdc6a6bcaa

  • SSDEEP

    6144:x9PWtNPrV/gCBXIr8a8n+uI7yVIIiwuA5N2Je2CWuPrOdz4ghWnsUbNKHBD28pJ1:x5WtJrx57vufA+JAYFhWZ5QBDzJ3LB

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2d561cebf83d31275c393a46ba73fa23.exe
    "C:\Users\Admin\AppData\Local\Temp\2d561cebf83d31275c393a46ba73fa23.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: RenamesItself
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Users\Admin\AppData\Local\Temp\2d561cebf83d31275c393a46ba73fa23.exe
      C:\Users\Admin\AppData\Local\Temp\2d561cebf83d31275c393a46ba73fa23.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\2d561cebf83d31275c393a46ba73fa23.exe

    Filesize

    385KB

    MD5

    eeeb83b154f21d637b4f5bf4c6e3aeea

    SHA1

    11a78e25567f9040bbdd2cd2532090c671ed30c1

    SHA256

    9605df99a25fa9131c788beaa741af8f53e9e76cb68783ea0210b1b8dd08ec0c

    SHA512

    6f6e2893b7163f8c7f87fbfc727a1f3b5489c2b044ada27ecc2a657d8a5a58bb00a9eb780db1d80715910bd08215761210c75b9ceed47c782be983b3d81027f4

  • C:\Users\Admin\AppData\Local\Temp\CabE68A.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\TarE6BC.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • \Users\Admin\AppData\Local\Temp\2d561cebf83d31275c393a46ba73fa23.exe

    Filesize

    155KB

    MD5

    a51e6f5575d50d444337f610de083954

    SHA1

    99894f4be04ba415bf24c8c9416d640dd28b2b52

    SHA256

    404c7f0ef1f4d6a57b18f72c2bc8f2cf32e2b560fa12ddfa2397b976f1304b40

    SHA512

    59481b9bd5aa20d6831a4773baf1d8a34eb653a0753b80afbeabd113e1a93e3fdf03dfb04c75adb9938285b04a14f64de93c64a1716dc8617a542e40a6ff3c42

  • memory/2752-23-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2752-17-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/2752-25-0x00000000002E0000-0x000000000033F000-memory.dmp

    Filesize

    380KB

  • memory/2752-20-0x0000000000270000-0x00000000002D6000-memory.dmp

    Filesize

    408KB

  • memory/2752-77-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2752-82-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/2752-83-0x00000000089B0000-0x00000000089EC000-memory.dmp

    Filesize

    240KB

  • memory/3032-15-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3032-12-0x0000000002D90000-0x0000000002DF6000-memory.dmp

    Filesize

    408KB

  • memory/3032-0-0x0000000000400000-0x0000000000466000-memory.dmp

    Filesize

    408KB

  • memory/3032-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/3032-1-0x0000000000220000-0x0000000000286000-memory.dmp

    Filesize

    408KB